Edit tour

Windows Analysis Report
Payment-Order #24560274 for 8,380 USD.exe

Overview

General Information

Sample name:	Payment-Order #24560274 for 8,380 USD.exe
Analysis ID:	1582316
MD5:	eac2017286abefbd21b28e7f9fcab248
SHA1:	02f90ba750bf3801e286ecfbf3467110f8b2ef94
SHA256:	e8f6dc455cea42a08feb8fcf5a34928864d537ec5ec905576cee58c9fabd6a5f
Tags:	exeuser-TeamDreier
Infos:

Detection

AsyncRAT, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected AsyncRAT

Yara detected PureLog Stealer

Yara detected UAC Bypass using CMSTP

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Disables UAC (registry)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Sample has a suspicious name (potential lure to open the executable)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

Payment-Order #24560274 for 8,380 USD.exe (PID: 7256 cmdline: "C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe" MD5: EAC2017286ABEFBD21B28E7F9FCAB248)

powershell.exe (PID: 7352 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe" -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7752 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

CasPol.exe (PID: 7400 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

CasPol.exe (PID: 7424 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

WerFault.exe (PID: 7520 cmdline: C:\Windows\system32\WerFault.exe -u -p 7256 -s 1028 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: AsyncRAT

{"Server": "91.223.3.156", "Ports": "7707,8808", "Version": "0.5.8", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "Hhll9M0e4lNnAyASCeNxW0bZeqomPsnN", "Mutex": "TcNC0kSWrpnZ", "Certificate": "MIIE8jCCAtqgAwIBAgIQANuvcDyw7qEgH8/hHGWHqzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjQwNTEyMTI0OTA3WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJdzTz3Veou5WnDQ98+tWByIlrDRKQGKkbazCczn0Ct7+4sThlLPimklMZ+f4RT57OsAzLlnLTtaFmOLqoZuOpHJXYjD1rjpx+gFScl9SBCVk8aDDCWBhDXe9cG4Vs5Eac3vPTYcOIJX8v/GB6NUvb1lXRgnlTYCttP50bgN1f4g+qbz4QFJx3VvXzka0jGewd+0elhblp5Y8Wp7otngd+SaMNDnLie9HNMUMY5al98pN0YGhUz3aPW6nV9lSlhI1Kp+PTrx3ubbSsqFgVTh3HhPELDFfYQhnbz7y5NKt478LHGHstq8qvpJd1RrmgUXqQ+U+yqvNnwWi1lC4x9exTZysfl6o/NL/YLIsy6PWAClqUMwrsVUEtvBkwnN+H9I4/z3jxaNaceFHKr2T0BhjLkwJxX/81HY2ChOigRmW6mtxM7PkMJek26H42rq9NTXnAniR2sOZAtU1Bse1E7dB3E8bgPVe8t0xlcoDJ1HBe8P5DRKGexuWBaWSI+/idWmPH6fdnQE4NjSkxc6jOIDaOz2B2CfuEuyza5FF23Qm3UIju4iBhbkkQ07ikYVh+KFFcmVJBV+SInQxSkKZRtm3fgCfCQSr9YHypuIVvoQg49wyw2K/tEBwBld7ChRpjrSiyZXFZyuad0C/oWTc0C4PrxmpOCrr/aEJkkzCXa7nWG5AgMBAAGjMjAwMB0GA1UdDgQWBBQ/VoJ/uA+0qEUprzCyevh/hBqWZjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA9ap836unSmbz6tOLXiWOy7ichSRTjF8EN74dwIBcla5ooNT7FsljjZPMZJYswa8By4rYITjzSUo7gJ4H0zZcIeeLRLDMeDjfZaPgr/XPHXFQFvoEj1YxqSdGZopOsC29FZNn+WLSW63GLwifvlJxyJsnJqaI+q1HDri1YUP3v2G5dAD2hH91GCA85k0Pc5yQuHQdcNeRm02kmhApG1zwQHvdFerRlySMH/kh1smRrYOvm/MJirQQaNaaqQSmkfDQPzhAmnwoRjSC0kmpMVnlry1SkSM4VPPAm3p40MqLQO/m2AqB5Q8L8GdtWgXbownBmUAFyjEplt1Z0/ZydU9EE0LreZ1M9/a8QCJv7KVtDBjDWPvJLDsRrWm0CMacEeWvALYSe4XTtIOvEipXEOGzp2TFLdX2pfv+/Fencajt+UXTXrx6GdotOt/dFdPkMi1haoVO54TWkU4b+XvPKi1+Kk8xnBe9tKaAb2awepoL0Td1G8Irk1dPwEnZoDMQZ0xciH2o2jv5VjL9heestdAQqraDWHYmTE3Epp5JYSWAlEdiinW5KouF99gkXipUT/q3mCDofr+8fjCBIhbl9nxZF/sg5mB296IAeLYPACl+aemri2BHrbmvFSA8pI7nohDp/bYiZ1FY95CzrV9p8ndK+EKIiXgsuDVDUFJjlIEfGoA==", "ServerSignature": "GlhXKNjmzjDXgtTRaHnX+SERJTWzBcBCzkA9cgIj6m2wjHscqGrjpcsaoYwLMcVUakGcYPAWjiCliHGLyQWCFOXopGt7ELHBQQfpd8aBd3w64xqXupsUU6P4O+RetxxzVOcd3XKAaiklChhInWet1Gzl0ID0jgbLtOFt7a8NuuBAMbMA2dZNQF1OVjn6/DRD6OaMIpjCKxsaWc/AYzXNm2HWrPF+xCP7R0D3wRPHCEQRJVN8Vq5R/PLF8S8RQ8Sd4e58szJFfuBYZSBJY/78wme2ypko/zCtICugPhNCJZJfpgsLuN1S1RZn4ZdSIeOmNtfKn9aihq+v7PxETHQNHB9w/dSaX/sSiA7QXCcKfEP9BIz2M6y2RtpNNKoXefNFZGbAOrccR1rCKNMRQFS5BYX6SPNspVn8+tByTurwSO72cLt3gyzJ5FujulFr2r5++/cKOfb5qOeMaaDfFWE+eTdqtVhcDPS1pD34N1CgmB6vJ5GUzGLyTzKrRRDAYW2fqhV8/fwG/SPIXg4OWOnplp9MpIyHJmlT5kx11nHTpOnoestbHvZC/5o7xalNsbHUGJxODX0a5IbdhdmZkMnmhrNKRVcOG7NHsAU5fjrCdTqX7nl2no+Db5fRzrI2sXsAQa2ReYLXUBYrsbIIaKgeohuTpYuArU3ppZLQczpMbzU=", "BDOS": "false", "External_config_on_Pastebin": "null"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.3303115562.00000000070C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000002.3295095977.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000004.00000002.3295095977.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x978d:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000000.00000002.2278087509.000002473B566000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000004.00000002.3302661683.0000000006E70000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
00000004.00000002.3302661683.0000000006E70000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000002.3302661683.0000000006E70000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x530d2:$s1: file:/// 0x52fda:$s2: {11111-22222-10009-11112} 0x53062:$s3: {11111-22222-50001-00000} 0x4d4fc:$s4: get_Module 0x4d9bb:$s5: Reverse 0x52991:$s6: BlockCopy 0x52ad4:$s7: ReadByte 0x530e4:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
00000000.00000002.2278087509.000002473B273000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.2278087509.000002473B273000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x4b0bb:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x564fb:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x4c3f8:$a2: Stub.exe 0x4c488:$a2: Stub.exe 0x57838:$a2: Stub.exe 0x578c8:$a2: Stub.exe 0x47ebf:$a3: get_ActivatePong 0x532ff:$a3: get_ActivatePong 0x4b2d3:$a4: vmware 0x56713:$a4: vmware 0x4b14b:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x5658b:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x48c1a:$a6: get_SslClient 0x5405a:$a6: get_SslClient
00000000.00000002.2278087509.000002473B273000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x4b14d:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x5658d:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000004.00000002.3296787969.00000000031C8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.3296787969.0000000003191000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000004.00000002.3298836507.0000000004197000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: Payment-Order #24560274 for 8,380 USD.exe PID: 7256	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: Payment-Order #24560274 for 8,380 USD.exe PID: 7256	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Payment-Order #24560274 for 8,380 USD.exe PID: 7256	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Payment-Order #24560274 for 8,380 USD.exe PID: 7256	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x8b5d:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: CasPol.exe PID: 7400	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: CasPol.exe PID: 7400	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: CasPol.exe PID: 7400	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x4309b:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.CasPol.exe.400000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.CasPol.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.CasPol.exe.400000.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x98fb:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x66ff:$a3: get_ActivatePong 0x9b13:$a4: vmware 0x998b:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x745a:$a6: get_SslClient
4.2.CasPol.exe.400000.0.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x66ff:$str01: get_ActivatePong 0x745a:$str02: get_SslClient 0x7476:$str03: get_TcpClient 0x5d0e:$str04: get_SendSync 0x5d5e:$str05: get_IsConnected 0x648d:$str06: set_UseShellExecute 0x9c31:$str07: Pastebin 0x9cb3:$str08: Select * from AntivirusProduct 0xac38:$str09: Stub.exe 0xacc8:$str09: Stub.exe 0x9a0b:$str10: timeout 3 > NUL 0x98fb:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x998b:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
4.2.CasPol.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x998d:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
4.2.CasPol.exe.441a9c8.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x7afb:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x8e38:$a2: Stub.exe 0x8ec8:$a2: Stub.exe 0x48ff:$a3: get_ActivatePong 0x7d13:$a4: vmware 0x7b8b:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x565a:$a6: get_SslClient
0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x48ff:$str01: get_ActivatePong 0x565a:$str02: get_SslClient 0x5676:$str03: get_TcpClient 0x3f0e:$str04: get_SendSync 0x3f5e:$str05: get_IsConnected 0x468d:$str06: set_UseShellExecute 0x7e31:$str07: Pastebin 0x7eb3:$str08: Select * from AntivirusProduct 0x8e38:$str09: Stub.exe 0x8ec8:$str09: Stub.exe 0x7c0b:$str10: timeout 3 > NUL 0x7afb:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x7b8b:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7b8d:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
4.2.CasPol.exe.70c0000.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x7afb:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x8e38:$a2: Stub.exe 0x8ec8:$a2: Stub.exe 0x48ff:$a3: get_ActivatePong 0x7d13:$a4: vmware 0x7b8b:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x565a:$a6: get_SslClient
0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x48ff:$str01: get_ActivatePong 0x565a:$str02: get_SslClient 0x5676:$str03: get_TcpClient 0x3f0e:$str04: get_SendSync 0x3f5e:$str05: get_IsConnected 0x468d:$str06: set_UseShellExecute 0x7e31:$str07: Pastebin 0x7eb3:$str08: Select * from AntivirusProduct 0x8e38:$str09: Stub.exe 0x8ec8:$str09: Stub.exe 0x7c0b:$str10: timeout 3 > NUL 0x7afb:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x7b8b:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7b8d:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x98fb:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x14d3b:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x16078:$a2: Stub.exe 0x16108:$a2: Stub.exe 0x66ff:$a3: get_ActivatePong 0x11b3f:$a3: get_ActivatePong 0x9b13:$a4: vmware 0x14f53:$a4: vmware 0x998b:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x14dcb:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x745a:$a6: get_SslClient 0x1289a:$a6: get_SslClient
0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x66ff:$str01: get_ActivatePong 0x11b3f:$str01: get_ActivatePong 0x745a:$str02: get_SslClient 0x1289a:$str02: get_SslClient 0x7476:$str03: get_TcpClient 0x128b6:$str03: get_TcpClient 0x5d0e:$str04: get_SendSync 0x1114e:$str04: get_SendSync 0x5d5e:$str05: get_IsConnected 0x1119e:$str05: get_IsConnected 0x648d:$str06: set_UseShellExecute 0x118cd:$str06: set_UseShellExecute 0x9c31:$str07: Pastebin 0x15071:$str07: Pastebin 0x9cb3:$str08: Select * from AntivirusProduct 0x150f3:$str08: Select * from AntivirusProduct 0xac38:$str09: Stub.exe 0xacc8:$str09: Stub.exe 0x16078:$str09: Stub.exe 0x16108:$str09: Stub.exe 0x9a0b:$str10: timeout 3 > NUL
0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x998d:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x14dcd:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
4.2.CasPol.exe.70c0000.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.CasPol.exe.6e70000.2.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
4.2.CasPol.exe.6e70000.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.CasPol.exe.6e70000.2.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x512d2:$s1: file:/// 0x511da:$s2: {11111-22222-10009-11112} 0x51262:$s3: {11111-22222-50001-00000} 0x4b6fc:$s4: get_Module 0x4bbbb:$s5: Reverse 0x50b91:$s6: BlockCopy 0x50cd4:$s7: ReadByte 0x512e4:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
4.2.CasPol.exe.6e70000.2.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
4.2.CasPol.exe.6e70000.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.CasPol.exe.6e70000.2.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x530d2:$s1: file:/// 0x52fda:$s2: {11111-22222-10009-11112} 0x53062:$s3: {11111-22222-50001-00000} 0x4d4fc:$s4: get_Module 0x4d9bb:$s5: Reverse 0x52991:$s6: BlockCopy 0x52ad4:$s7: ReadByte 0x530e4:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
4.2.CasPol.exe.441a9c8.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x98fb:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x66ff:$a3: get_ActivatePong 0x9b13:$a4: vmware 0x998b:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x745a:$a6: get_SslClient
0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x66ff:$str01: get_ActivatePong 0x745a:$str02: get_SslClient 0x7476:$str03: get_TcpClient 0x5d0e:$str04: get_SendSync 0x5d5e:$str05: get_IsConnected 0x648d:$str06: set_UseShellExecute 0x9c31:$str07: Pastebin 0x9cb3:$str08: Select * from AntivirusProduct 0xac38:$str09: Stub.exe 0xacc8:$str09: Stub.exe 0x9a0b:$str10: timeout 3 > NUL 0x98fb:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x998b:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x998d:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 28 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe", ParentImage: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe, ParentProcessId: 7256, ParentProcessName: Payment-Order #24560274 for 8,380 USD.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe" -Force, ProcessId: 7352, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe", ParentImage: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe, ParentProcessId: 7256, ParentProcessName: Payment-Order #24560274 for 8,380 USD.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe" -Force, ProcessId: 7352, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T10:57:06.198518+0100	2035595	1	Domain Observed Used for C2 Detected	91.223.3.156	8808	192.168.2.5	49709	TCP

ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T10:57:06.198518+0100	2035607	1	Domain Observed Used for C2 Detected	91.223.3.156	8808	192.168.2.5	49709	TCP

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T10:57:06.198518+0100	2842478	1	Malware Command and Control Activity Detected	91.223.3.156	8808	192.168.2.5	49709	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.2278087509.000002473B273000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: AsyncRAT {"Server": "91.223.3.156", "Ports": "7707,8808", "Version": "0.5.8", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "Hhll9M0e4lNnAyASCeNxW0bZeqomPsnN", "Mutex": "TcNC0kSWrpnZ", "Certificate": "MIIE8jCCAtqgAwIBAgIQANuvcDyw7qEgH8/hHGWHqzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjQwNTEyMTI0OTA3WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJdzTz3Veou5WnDQ98+tWByIlrDRKQGKkbazCczn0Ct7+4sThlLPimklMZ+f4RT57OsAzLlnLTtaFmOLqoZuOpHJXYjD1rjpx+gFScl9SBCVk8aDDCWBhDXe9cG4Vs5Eac3vPTYcOIJX8v/GB6NUvb1lXRgnlTYCttP50bgN1f4g+qbz4QFJx3VvXzka0jGewd+0elhblp5Y8Wp7otngd+SaMNDnLie9HNMUMY5al98pN0YGhUz3aPW6nV9lSlhI1Kp+PTrx3ubbSsqFgVTh3HhPELDFfYQhnbz7y5NKt478LHGHstq8qvpJd1RrmgUXqQ+U+yqvNnwWi1lC4x9exTZysfl6o/NL/YLIsy6PWAClqUMwrsVUEtvBkwnN+H9I4/z3jxaNaceFHKr2T0BhjLkwJxX/81HY2ChOigRmW6mtxM7PkMJek26H42rq9NTXnAniR2sOZAtU1Bse1E7dB3E8bgPVe8t0xlcoDJ1HBe8P5DRKGexuWBaWSI+/idWmPH6fdnQE4NjSkxc6jOIDaOz2B2CfuEuyza5FF23Qm3UIju4iBhbkkQ07ikYVh+KFFcmVJBV+SInQxSkKZRtm3fgCfCQSr9YHypuIVvoQg49wyw2K/tEBwBld7ChRpjrSiyZXFZyuad0C/oWTc0C4PrxmpOCrr/aEJkkzCXa7nWG5AgMBAAGjMjAwMB0GA1UdDgQWBBQ/VoJ/uA+0qEUprzCyevh/hBqWZjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA9ap836unSmbz6tOLXiWOy7ichSRTjF8EN74dwIBcla5ooNT7FsljjZPMZJYswa8By4rYITjzSUo7gJ4H0zZcIeeLRLDMeDjfZaPgr/XPHXFQFvoEj1YxqSdGZopOsC29FZNn+WLSW63GLwifvlJxyJsnJqaI+q1HDri1YUP3v2G5dAD2hH91GCA85k0Pc5yQuHQdcNeRm02kmhApG1zwQHvdFerRlySMH/kh1smRrYOvm/MJirQQaNaaqQSmkfDQPzhAmnwoRjSC0kmpMVnlry1SkSM4VPPAm3p40MqLQO/m2AqB5Q8L8GdtWgXbownBmUAFyjEplt1Z0/ZydU9EE0LreZ1M9/a8QCJv7KVtDBjDWPvJLDsRrWm0CMacEeWvALYSe4XTtIOvEipXEOGzp2TFLdX2pfv+/Fencajt+UXTXrx6GdotOt/dFdPkMi1haoVO54TWkU4b+XvPKi1+Kk8xnBe9tKaAb2awepoL0Td1G8Irk1dPwEnZoDMQZ0xciH2o2jv5VjL9heestdAQqraDWHYmTE3Epp5JYSWAlEdiinW5KouF99gkXipUT/q3mCDofr+8fjCBIhbl9nxZF/sg5mB296IAeLYPACl+aemri2BHrbmvFSA8pI7nohDp/bYiZ1FY95CzrV9p8ndK+EKIiXgsuDVDUFJjlIEfGoA==", "ServerSignature": "GlhXKNjmzjDXgtTRaHnX+SERJTWzBcBCzkA9cgIj6m2wjHscqGrjpcsaoYwLMcVUakGcYPAWjiCliHGLyQWCFOXopGt7ELHBQQfpd8aBd3w64xqXupsUU6P4O+RetxxzVOcd3XKAaiklChhInWet1Gzl0ID0jgbLtOFt7a8NuuBAMbMA2dZNQF1OVjn6/DRD6OaMIpjCKxsaWc/AYzXNm2HWrPF+xCP7R0D3wRPHCEQRJVN8Vq5R/PLF8S8RQ8Sd4e58szJFfuBYZSBJY/78wme2ypko/zCtICugPhNCJZJfpgsLuN1S1RZn4ZdSIeOmNtfKn9aihq+v7PxETHQNHB9w/dSaX/sSiA7QXCcKfEP9BIz2M6y2RtpNNKoXefNFZGbAOrccR1rCKNMRQFS5BYX6SPNspVn8+tByTurwSO72cLt3gyzJ5FujulFr2r5++/cKOfb5qOeMaaDfFWE+eTdqtVhcDPS1pD34N1CgmB6vJ5GUzGLyTzKrRRDAYW2fqhV8/fwG/SPIXg4OWOnplp9MpIyHJmlT5kx11nHTpOnoestbHvZC/5o7xalNsbHUGJxODX0a5IbdhdmZkMnmhrNKRVcOG7NHsAU5fjrCdTqX7nl2no+Db5fRzrI2sXsAQa2ReYLXUBYrsbIIaKgeohuTpYuArU3ppZLQczpMbzU=", "BDOS": "false", "External_config_on_Pastebin": "null"}

Multi AV Scanner detection for submitted file

Source: Payment-Order #24560274 for 8,380 USD.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Payment-Order #24560274 for 8,380 USD.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.2278087509.000002473B566000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment-Order #24560274 for 8,380 USD.exe PID: 7256, type: MEMORYSTR

Source: Payment-Order #24560274 for 8,380 USD.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.pdbq1 source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER5D2A.tmp.dmp.8.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 91.223.3.156:8808 -> 192.168.2.5:49709
Source: Network traffic	Suricata IDS: 2030673 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 91.223.3.156:8808 -> 192.168.2.5:49709
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 91.223.3.156:8808 -> 192.168.2.5:49709
Source: Network traffic	Suricata IDS: 2035607 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 91.223.3.156:8808 -> 192.168.2.5:49709

Yara detected Generic Downloader

Source: Yara match	File source: 4.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.5:49709 -> 91.223.3.156:8808

Source: Joe Sandbox View

ASN Name: PL-SKYTECH-ASPL PL-SKYTECH-ASPL

Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156
Source: unknown	TCP traffic detected without corresponding DNS query: 91.223.3.156

Source: CasPol.exe, 00000004.00000002.3300056611.00000000053A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: CasPol.exe, 00000004.00000002.3300056611.00000000053A6000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: CasPol.exe, 00000004.00000002.3296787969.0000000003191000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 4.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3295095977.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2278087509.000002473B273000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3296787969.0000000003191000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment-Order #24560274 for 8,380 USD.exe PID: 7256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 7400, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 4.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 4.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 4.2.CasPol.exe.6e70000.2.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 4.2.CasPol.exe.6e70000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000004.00000002.3295095977.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000004.00000002.3302661683.0000000006E70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects zgRAT Author: ditekSHen
Source: 00000000.00000002.2278087509.000002473B273000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000000.00000002.2278087509.000002473B273000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: Payment-Order #24560274 for 8,380 USD.exe PID: 7256, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: CasPol.exe PID: 7400, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Payment-Order #24560274 for 8,380 USD.exe

Sample has a suspicious name (potential lure to open the executable)

Source: Payment-Order #24560274 for 8,380 USD.exe

Static file information: Suspicious name

Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Code function: 0_2_00007FF848E73148	0_2_00007FF848E73148
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Code function: 0_2_00007FF848E87A40	0_2_00007FF848E87A40
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Code function: 0_2_00007FF848E7B3F1	0_2_00007FF848E7B3F1
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Code function: 0_2_00007FF848E70C48	0_2_00007FF848E70C48
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Code function: 0_2_00007FF848E7DF79	0_2_00007FF848E7DF79
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Code function: 0_2_00007FF848E77F68	0_2_00007FF848E77F68
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Code function: 0_2_00007FF848E7AF69	0_2_00007FF848E7AF69
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Code function: 0_2_00007FF848E840A1	0_2_00007FF848E840A1
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Code function: 0_2_00007FF848F40060	0_2_00007FF848F40060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_02CA65C0	4_2_02CA65C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_02CAC518	4_2_02CAC518
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_02CA5CF0	4_2_02CA5CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_02CAC1A8	4_2_02CAC1A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_02CAA7A8	4_2_02CAA7A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_02CAC508	4_2_02CAC508
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_02CA59A8	4_2_02CA59A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06F3CEA0	4_2_06F3CEA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06F3E2A0	4_2_06F3E2A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06F36A08	4_2_06F36A08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06F3B3D8	4_2_06F3B3D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06F38B58	4_2_06F38B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06F321D8	4_2_06F321D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06F35638	4_2_06F35638
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06F3EFB0	4_2_06F3EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06F38040	4_2_06F38040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06F5B6A8	4_2_06F5B6A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06F5E377	4_2_06F5E377
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06F5B348	4_2_06F5B348
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06F5B6AA	4_2_06F5B6AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06F5B33B	4_2_06F5B33B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_073E5F40	4_2_073E5F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_073E9BA0	4_2_073E9BA0

Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7256 -s 1028

Source: Payment-Order #24560274 for 8,380 USD.exe

Static PE information: No import functions for PE file found

Source: Payment-Order #24560274 for 8,380 USD.exe, 00000000.00000002.2278087509.000002473B273000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs Payment-Order #24560274 for 8,380 USD.exe
Source: Payment-Order #24560274 for 8,380 USD.exe, 00000000.00000002.2278775339.000002474B221000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAbupodobego6 vs Payment-Order #24560274 for 8,380 USD.exe
Source: Payment-Order #24560274 for 8,380 USD.exe, 00000000.00000002.2279823552.00000247539E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAbupodobego6 vs Payment-Order #24560274 for 8,380 USD.exe
Source: Payment-Order #24560274 for 8,380 USD.exe	Binary or memory string: OriginalFilename vs Payment-Order #24560274 for 8,380 USD.exe

Source: 4.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 4.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 4.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 4.2.CasPol.exe.6e70000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 4.2.CasPol.exe.6e70000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000004.00000002.3295095977.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000004.00000002.3302661683.0000000006E70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 00000000.00000002.2278087509.000002473B273000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000000.00000002.2278087509.000002473B273000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: Payment-Order #24560274 for 8,380 USD.exe PID: 7256, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: CasPol.exe PID: 7400, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: Payment-Order #24560274 for 8,380 USD.exe

Static PE information: Section: .rsrc ZLIB complexity 0.9974721272786459

Source: Payment-Order #24560274 for 8,380 USD.exe, --------.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 4.2.CasPol.exe.70c0000.3.raw.unpack, kMtwg0o70HMbUjS709M9.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.CasPol.exe.70c0000.3.raw.unpack, kMtwg0o70HMbUjS709M9.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.CasPol.exe.441a9c8.1.raw.unpack, kMtwg0o70HMbUjS709M9.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.CasPol.exe.441a9c8.1.raw.unpack, kMtwg0o70HMbUjS709M9.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.CasPol.exe.6e70000.2.raw.unpack, cYd7gkg5kb02RlPYIyY0.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.CasPol.exe.6e70000.2.raw.unpack, cYd7gkg5kb02RlPYIyY0.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.raw.unpack, Settings.cs	Base64 encoded string: 'tsRO0yQpdcvGyPGWH4f9I/usYxrWaW4dxt26/J7TncEk7sgaX89kTdwFXzXWhea2o9br9AqZrfEZbee1BMZ44A==', '/Ay63r9CkMbsGCbO46kf5d3vd1MP4ASQbnlcSvy5kWSsD/pvWhKg5ajrofVdMao8bx6MknIjHNnDPvWdCJOC1A==', 'GqV2IpFb1k90cf6PzciIIvvfH6YclzJ3Ar0pX57PEazXix0QSHrvXssIQ6jaCHAv4gyz8qrntSdounxRrCLgcg==', 'vG4jfWk4iKWEyOIgVofQpfKFGVliWObdzNotxZB+Z0pBgn1gNRnptNUyXLlEV7mOuFQINYzNJjYch6I/eZf2Dw=='
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.raw.unpack, Settings.cs	Base64 encoded string: 'tsRO0yQpdcvGyPGWH4f9I/usYxrWaW4dxt26/J7TncEk7sgaX89kTdwFXzXWhea2o9br9AqZrfEZbee1BMZ44A==', '/Ay63r9CkMbsGCbO46kf5d3vd1MP4ASQbnlcSvy5kWSsD/pvWhKg5ajrofVdMao8bx6MknIjHNnDPvWdCJOC1A==', 'GqV2IpFb1k90cf6PzciIIvvfH6YclzJ3Ar0pX57PEazXix0QSHrvXssIQ6jaCHAv4gyz8qrntSdounxRrCLgcg==', 'vG4jfWk4iKWEyOIgVofQpfKFGVliWObdzNotxZB+Z0pBgn1gNRnptNUyXLlEV7mOuFQINYzNJjYch6I/eZf2Dw=='

Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@10/12@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7256
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Mutant created: \Sessions\1\BaseNamedObjects\TcNC0kSWrpnZ
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7360:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_epbliuql.uib.ps1

Jump to behavior

Source: Payment-Order #24560274 for 8,380 USD.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Payment-Order #24560274 for 8,380 USD.exe

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe "C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe"
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7256 -s 1028
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Payment-Order #24560274 for 8,380 USD.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Payment-Order #24560274 for 8,380 USD.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.pdbq1 source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WER5D2A.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER5D2A.tmp.dmp.8.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 4.2.CasPol.exe.70c0000.3.raw.unpack, kMtwg0o70HMbUjS709M9.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 4.2.CasPol.exe.441a9c8.1.raw.unpack, kMtwg0o70HMbUjS709M9.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 4.2.CasPol.exe.6e70000.2.raw.unpack, cYd7gkg5kb02RlPYIyY0.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: 4.2.CasPol.exe.6e70000.2.raw.unpack, AssemblyLoader.cs

.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])

Yara detected Costura Assembly Loader

Source: Yara match	File source: 00000004.00000002.3296787969.00000000031C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 7400, type: MEMORYSTR

Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Code function: 0_2_00007FF848E8DEC8 push E8000016h; ret	0_2_00007FF848E8DEF9
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Code function: 0_2_00007FF848E78167 push ebx; ret	0_2_00007FF848E7816A
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Code function: 0_2_00007FF848E87967 push ebx; retf	0_2_00007FF848E8796A
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Code function: 0_2_00007FF848E77BD8 pushad ; retf	0_2_00007FF848E77C5D
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Code function: 0_2_00007FF848E77C5E push eax; retf	0_2_00007FF848E77C6D
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Code function: 0_2_00007FF848E84E4A push esp; retf	0_2_00007FF848E84E4C
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Code function: 0_2_00007FF848E86F29 push cs; iretd	0_2_00007FF848E86F3F
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Code function: 0_2_00007FF848E700BD pushad ; iretd	0_2_00007FF848E700C1
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Code function: 0_2_00007FF848E77890 push eax; retf	0_2_00007FF848E778AD
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Code function: 0_2_00007FF848F40060 push esp; retf 4810h	0_2_00007FF848F40312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_02CAE407 push 8B041980h; retf	4_2_02CAE40C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06F3CA2B push eax; retf	4_2_06F3CA33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06F30006 push es; retf	4_2_06F3001C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_073D7100 push ebx; ret	4_2_073D710A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_073D25ED push ebp; retn 0000h	4_2_073D25EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_076B6902 push eax; retf	4_2_076B690D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_076B7106 push esp; ret	4_2_076B7109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_076B71AE pushfd ; retf	4_2_076B71AF

Source: 4.2.CasPol.exe.70c0000.3.raw.unpack, QisSSXoFjUNPRyebPKUc.cs	High entropy of concatenated method names: 'v87oFT0wtQ4', 'J5roFSvPCjR', 'joGoF4tyrXN', 'JRDoFdABYTM', 'j91oF7v1EOr', 'AYFoF1K6jGX', 'vTboFFZSGZp', 'Wj8oFGqlJpZ', 'TiroFk9Rur2', 'zTEoFMeJJRf'
Source: 4.2.CasPol.exe.70c0000.3.raw.unpack, Connection.cs	High entropy of concatenated method names: 'gTno7tNfvVQ', 'dr53PUohPCPIL68U61S7', 'l1dThaohAGMU1gnt8yNH', 'o1QodeniRPA', 'VQXodjO1FJN', 'k1LodKRNX6J', 'Ldmodwu6Zx7', 'GKuod0CLlVX', 'TFrodHTD5Be', 'UTvodDZfZbd'
Source: 4.2.CasPol.exe.70c0000.3.raw.unpack, kMtwg0o70HMbUjS709M9.cs	High entropy of concatenated method names: 'y2QsfpohB7Zf1Nl7XDHk', 'n6mGHaohJD7ITsIwSaF7', 'N2uo1v2XGV3', 'lnCHhaoBZ3pR9Ag4Ghr2', 'tkUIKToB2UnNqkWKgtAH', 'gg5AoLoBIYEvcUqSxruC', 'm65rVMoBgf1EuEv0SGBT', 'xJrXxtoBXB9dZOKOxuLv', 'mpM5QooBo71SoBKYglw3', 'sD0nIPoBuVdNCUJGy1Oi'
Source: 4.2.CasPol.exe.70c0000.3.raw.unpack, Y4YEPAoF6Ge9CZK1Z7MK.cs	High entropy of concatenated method names: 'ug4oN2aOqti', 'cWioNIYKiTn', 'DXioNgl28Qb', 'CqfoNX4SOGs', 'GwPoNo2a3AI', 'S41oNuQkqdX', 'l8boNYA8Kbu', 'wIloGIRWZO5', 'QJuoNbwxvZU', 'gCKoNW1bqLX'
Source: 4.2.CasPol.exe.441a9c8.1.raw.unpack, QisSSXoFjUNPRyebPKUc.cs	High entropy of concatenated method names: 'v87oFT0wtQ4', 'J5roFSvPCjR', 'joGoF4tyrXN', 'JRDoFdABYTM', 'j91oF7v1EOr', 'AYFoF1K6jGX', 'vTboFFZSGZp', 'Wj8oFGqlJpZ', 'TiroFk9Rur2', 'zTEoFMeJJRf'
Source: 4.2.CasPol.exe.441a9c8.1.raw.unpack, Connection.cs	High entropy of concatenated method names: 'gTno7tNfvVQ', 'dr53PUohPCPIL68U61S7', 'l1dThaohAGMU1gnt8yNH', 'o1QodeniRPA', 'VQXodjO1FJN', 'k1LodKRNX6J', 'Ldmodwu6Zx7', 'GKuod0CLlVX', 'TFrodHTD5Be', 'UTvodDZfZbd'
Source: 4.2.CasPol.exe.441a9c8.1.raw.unpack, kMtwg0o70HMbUjS709M9.cs	High entropy of concatenated method names: 'y2QsfpohB7Zf1Nl7XDHk', 'n6mGHaohJD7ITsIwSaF7', 'N2uo1v2XGV3', 'lnCHhaoBZ3pR9Ag4Ghr2', 'tkUIKToB2UnNqkWKgtAH', 'gg5AoLoBIYEvcUqSxruC', 'm65rVMoBgf1EuEv0SGBT', 'xJrXxtoBXB9dZOKOxuLv', 'mpM5QooBo71SoBKYglw3', 'sD0nIPoBuVdNCUJGy1Oi'
Source: 4.2.CasPol.exe.441a9c8.1.raw.unpack, Y4YEPAoF6Ge9CZK1Z7MK.cs	High entropy of concatenated method names: 'ug4oN2aOqti', 'cWioNIYKiTn', 'DXioNgl28Qb', 'CqfoNX4SOGs', 'GwPoNo2a3AI', 'S41oNuQkqdX', 'l8boNYA8Kbu', 'wIloGIRWZO5', 'QJuoNbwxvZU', 'gCKoNW1bqLX'
Source: 4.2.CasPol.exe.6e70000.2.raw.unpack, AssemblyLoader.cs	High entropy of concatenated method names: 'CultureToString', 'ReadExistingAssembly', 'CopyTo', 'LoadStream', 'LoadStream', 'ReadStream', 'ReadFromEmbeddedResources', 'ResolveAssembly', 'Attach', 'yeNyX7XtpfWlYdyyWioc'
Source: 4.2.CasPol.exe.6e70000.2.raw.unpack, YDxPsJgvLQogBp7kaFgL.cs	High entropy of concatenated method names: 'LgNgzyFPq1E', 'KDEgz8ayUUk', 'WuygzfKmvue', 'SXFgzt65y3R', 'tLJgzlY9cA3', 'G1Pgzet8wIy', 'FlBgzj5Jqb5', 'KLZgqm3JDEa', 'zOlgzms9DCO', 'ClmgzKcJeQ9'
Source: 4.2.CasPol.exe.6e70000.2.raw.unpack, CfIG1Sgvd0JX4DSAabU6.cs	High entropy of concatenated method names: 'bWpgvsbS5Re', 'MPOgvEX8Zp6', 'sijgvUpZUr2', 'cLPgvpfnC59', 'ql8gvnlkVHT', 'HVPgvaOwklA', 'gLkgv9481Wo', 'ptKgvVmUlrv', 'JfigvOqAySm', 'SD3gv5H3r8P'
Source: 4.2.CasPol.exe.6e70000.2.raw.unpack, Connection.cs	High entropy of concatenated method names: 'o5FgOAPwgvB', 'hANJpKXfEReTdqfOwsxS', 'qijudOXfU98NGGbQb0GA', 'RIvgO7QIyta', 'InitializeClient', 'VDggOd33BCs', 'Disconnected', 'Send', 'CheckServer', 'MqwNMxXfN1GTRtSYlbxZ'
Source: 4.2.CasPol.exe.6e70000.2.raw.unpack, Chromium.cs	High entropy of concatenated method names: 'Recovery', 'niQg5Qo4j4l', 'pDjg5Txdnl7', 'DecryptWithKey', 'GetMasterKey', 'Decrypt', 'QPxg5Sbwgwi', 'LadWpuXt15LIyisemmWk', 'NHFOp1XtFAUfXrBRRrLg', 'JtN6IOXtGG1O2d0iSpv9'
Source: 4.2.CasPol.exe.6e70000.2.raw.unpack, cYd7gkg5kb02RlPYIyY0.cs	High entropy of concatenated method names: 'gEG1DUXlKtIpXe7mbPt2', 'VY5r68XlwBf4ubGceN2T', 'bBxs5pXljlBJeynLfaPc', 'r7hgvY1kPCN', 'xL4RXgXl3OUVWklwWffQ', 'OWfrhEXlDdBUL5RGniRv', 'wF1WtxXliuEB4QSDyVco', 'dkuV3yXlrtyp6HBoLjHR', 'poZ7jFXlQLve25L5PLj6', 'hG28NbXlThkNVgLjHxk2'

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 4.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3295095977.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2278087509.000002473B273000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3296787969.0000000003191000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment-Order #24560274 for 8,380 USD.exe PID: 7256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 7400, type: MEMORYSTR

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\5C3306B6AC50791BED22 7FD48AC68F182E0CED2ACE00B223FA1D35BD8A20D75600B5400267CD5DB5CC84

Jump to behavior

Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Payment-Order #24560274 for 8,380 USD.exe PID: 7256, type: MEMORYSTR

Yara detected AsyncRAT

Source: Yara match	File source: 4.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3295095977.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2278087509.000002473B273000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3296787969.0000000003191000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment-Order #24560274 for 8,380 USD.exe PID: 7256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 7400, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Payment-Order #24560274 for 8,380 USD.exe, 00000000.00000002.2278087509.000002473B566000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Payment-Order #24560274 for 8,380 USD.exe, 00000000.00000002.2278087509.000002473B273000.00000004.00000800.00020000.00000000.sdmp, Payment-Order #24560274 for 8,380 USD.exe, 00000000.00000002.2278087509.000002473B566000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000004.00000002.3295095977.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Memory allocated: 247399A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Memory allocated: 24753210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 2C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 3190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 5190000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6889	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: threadDelayed 9780	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7672	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7852	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7884	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7892	Thread sleep count: 73 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7892	Thread sleep count: 9780 > 30	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Payment-Order #24560274 for 8,380 USD.exe, 00000000.00000002.2278087509.000002473B566000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: CasPol.exe, 00000004.00000002.3300056611.00000000053A6000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000004.00000002.3296072683.000000000112B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Payment-Order #24560274 for 8,380 USD.exe, 00000000.00000002.2278087509.000002473B566000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: Payment-Order #24560274 for 8,380 USD.exe, 00000000.00000002.2278087509.000002473B566000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Payment-Order #24560274 for 8,380 USD.exe, 00000000.00000002.2278087509.000002473B566000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Payment-Order #24560274 for 8,380 USD.exe, 00000000.00000002.2278087509.000002473B566000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Payment-Order #24560274 for 8,380 USD.exe, 00000000.00000002.2278087509.000002473B566000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: CasPol.exe, 00000004.00000002.3295095977.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Payment-Order #24560274 for 8,380 USD.exe, 00000000.00000002.2278087509.000002473B566000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Payment-Order #24560274 for 8,380 USD.exe, 00000000.00000002.2278087509.000002473B566000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Payment-Order #24560274 for 8,380 USD.exe, 00000000.00000002.2278087509.000002473B566000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Payment-Order #24560274 for 8,380 USD.exe, 00000000.00000002.2278087509.000002473B566000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Payment-Order #24560274 for 8,380 USD.exe, 00000000.00000002.2279938132.0000024753B10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe" -Force
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe" -Force			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 40E000	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 410000	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: C63008	Jump to behavior

Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior

Source: CasPol.exe, 00000004.00000002.3296787969.00000000032A5000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000004.00000002.3296787969.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000004.00000002.3296787969.0000000003347000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\]q
Source: CasPol.exe, 00000004.00000002.3296787969.00000000032A5000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000004.00000002.3296787969.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000004.00000002.3296787969.0000000003347000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: CasPol.exe, 00000004.00000002.3296787969.0000000003347000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe]q`
Source: CasPol.exe, 00000004.00000002.3296787969.00000000032A5000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000004.00000002.3296787969.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000004.00000002.3296787969.0000000003347000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\]q%
Source: CasPol.exe, 00000004.00000002.3296787969.0000000003291000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe]q(4)
Source: CasPol.exe, 00000004.00000002.3296787969.00000000032A5000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000004.00000002.3296787969.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000004.00000002.3296787969.0000000003347000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe]q

Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe	Queries volume information: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 4.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2b47c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment-Order #24560274 for 8,380 USD.exe.2473b2bfc00.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3295095977.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2278087509.000002473B273000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3296787969.0000000003191000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment-Order #24560274 for 8,380 USD.exe PID: 7256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 7400, type: MEMORYSTR

Disables UAC (registry)

Source: C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 4.2.CasPol.exe.441a9c8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.CasPol.exe.70c0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.CasPol.exe.70c0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.CasPol.exe.6e70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.CasPol.exe.6e70000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.CasPol.exe.441a9c8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3303115562.00000000070C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3302661683.0000000006E70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3298836507.0000000004197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: 4.2.CasPol.exe.6e70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.CasPol.exe.6e70000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3302661683.0000000006E70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 4.2.CasPol.exe.441a9c8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.CasPol.exe.70c0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.CasPol.exe.70c0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.CasPol.exe.6e70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.CasPol.exe.6e70000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.CasPol.exe.441a9c8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3303115562.00000000070C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3302661683.0000000006E70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3298836507.0000000004197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: 4.2.CasPol.exe.6e70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.CasPol.exe.6e70000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3302661683.0000000006E70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Scheduled Task/Job	312 Process Injection	1 Modify Registry	OS Credential Dumping	131 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	21 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	312 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	111 Obfuscated Files or Information	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Payment-Order #24560274 for 8,380 USD.exe	39%	ReversingLabs	ByteCode-MSIL.Trojan.InjectorNetT
Payment-Order #24560274 for 8,380 USD.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.35	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.8.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	CasPol.exe, 00000004.00000002.3296787969.0000000003191000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
91.223.3.156	unknown	Poland		201814	PL-SKYTECH-ASPL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582316
Start date and time:	2024-12-30 10:56:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Payment-Order #24560274 for 8,380 USD.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@10/12@0/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 89% Number of executed functions: 232 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 217.20.57.35, 13.89.179.12, 20.190.159.23, 20.109.210.53, 13.107.246.45, 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target CasPol.exe, PID 7400 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:57:01	API Interceptor	22x Sleep call for process: powershell.exe modified
04:57:06	API Interceptor	1x Sleep call for process: CasPol.exe modified
04:57:22	API Interceptor	1x Sleep call for process: WerFault.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	PersonnelPolicies.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	217.20.57.37
	EiO4tqZ3o4.exe	Get hash	malicious	AsyncRAT	Browse	217.20.58.100
	wce.exe	Get hash	malicious	Unknown	Browse	217.20.58.98
	nXNMsYXFFc.exe	Get hash	malicious	Unknown	Browse	217.20.58.100
	5RaYXoKFn9.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	217.20.58.98
	msgde.exe	Get hash	malicious	Quasar	Browse	217.20.58.99
	atw3.dll	Get hash	malicious	Gozi, Ursnif	Browse	217.20.58.100
	WRD1792.docx.doc	Get hash	malicious	Dynamer	Browse	217.20.58.99
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	217.20.58.98
	0442.pdf.exe	Get hash	malicious	Unknown	Browse	217.20.58.100
bg.microsoft.map.fastly.net	SecuredOnedrive.ClientSetup.exe	Get hash	malicious	ScreenConnect Tool	Browse	199.232.214.172
	dsoft.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	199.232.210.172
	Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Get hash	malicious	BlackMoon	Browse	199.232.210.172
	Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Get hash	malicious	BlackMoon	Browse	199.232.214.172
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer, Xmrig	Browse	199.232.214.172
	3KFFG52TBI.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	a2mNMrPxow.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	tzA45NGAW4.lnk	Get hash	malicious	Unknown	Browse	199.232.210.172
	sYPORwmgwQ.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	New Upd v1.1.0.exe	Get hash	malicious	LummaC	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PL-SKYTECH-ASPL	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	149.86.227.88
	https://lvxsystem.info/	Get hash	malicious	Unknown	Browse	5.181.188.191
	bad.txt	Get hash	malicious	AsyncRAT	Browse	193.34.212.115
	gagagggagagag.exe	Get hash	malicious	AsyncRAT	Browse	185.16.38.41
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	149.86.226.5
	Bestellung - 021224 - 901003637.exe	Get hash	malicious	Quasar	Browse	193.34.212.17
	Zam.exe	Get hash	malicious	Discord Token Stealer, PureLog Stealer	Browse	193.34.212.17
	KRcLFIz5PCQunB7.exe	Get hash	malicious	Quasar	Browse	193.34.212.17
	file.exe	Get hash	malicious	WhiteSnake Stealer	Browse	91.223.3.164
	Payload 94.75 (3).225.exe	Get hash	malicious	Unknown	Browse	95.214.53.96

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Payment-Order #2_f96334feb1c271282e45732209aa89387a7faf_274b19cb_63f98574-5a4a-4425-87bc-dd148dd85d76\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1780396849585004
Encrypted:	false
SSDEEP:	192:gmDplTj0UnU9aWB2WelirdzuiFyZ24lO8L:dDplTQUnU9am2WpzuiFyY4lO8L
MD5:	FFD4772A7FDDF0BC9E554EB1682BCA80
SHA1:	D9FEE1D4825C8816B6B541FBEC709BB75BA86BC6
SHA-256:	E1A2C00F9993E74C71E38F3DC0B0E8C58D20F5E9282EDA43E111311A960DAE09
SHA-512:	F18A20727B9DE875DA2C61A709B92457ADADB2E1EA1602ACB1521C28EF284B8B0110A535CC01022FBA9A795E4398A5E08E49634E24F393A43D6DA5585690ACE6
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.0.2.6.2.2.0.7.5.2.1.8.7.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.0.2.6.2.2.1.4.5.5.3.1.3.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.3.f.9.8.5.7.4.-.5.a.4.a.-.4.4.2.5.-.8.7.b.c.-.d.d.1.4.8.d.d.8.5.d.7.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.4.3.c.d.f.4.3.-.b.c.9.1.-.4.0.c.c.-.b.5.9.e.-.b.a.e.c.e.e.f.8.5.c.d.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.P.a.y.m.e.n.t.-.O.r.d.e.r. .#.2.4.5.6.0.2.7.4. .f.o.r. .8.,.3.8.0. .U.S.D...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=..\q\..e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.5.8.-.0.0.0.1.-.0.0.1.4.-.a.4.1.3.-.2.7.2.a.a.1.5.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.f.9.6.b.6.1.7.9.c.7.6.6.0.e.4.c.3.b.9.8.d.8.b.b.e.7.0.1.a.5.e.0.0.0.0.0.0.0.0.!.0.0.0.0.0.2.f.9.0.b.a.7.5.0.b.f.3.8.0.1.e.2.8.6.e.c.f.b.f.3.4.6.7.1.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D2A.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Mon Dec 30 09:57:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	457177
Entropy (8bit):	3.2697524350125273
Encrypted:	false
SSDEEP:	3072:t3WmG/W9J9ecSsXQldKlTe1CCqz1QehxkWS3wulFCT3+vJiXvXEy74IjPj:tFGQ+iAykqz1QehxkWS3wt3QJiXvf1j
MD5:	72F880797C2AB7749EEAA4D49960F390
SHA1:	26C3101CC4752DEC97D15D8B8492A4346770F4F8
SHA-256:	131CE13D60FBB0A2891D54C33D466CF28C3AD435E13A50C21A18689BCC8B9C18
SHA-512:	1C417A1B770A2CACD5D9400AFE7AC99E12AD703DA0AA81BE57B588FC2DA0717099F0D2132E89F80CBC017934C5BE7027C6C26297245B3CCEA2D75A0FA9E1A3B1
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......mnrg............D...........p...d.......$....$......X....$.......I..............l.......8...........T............8..............PA..........<C..............................................................................eJ.......C......Lw......................T.......X...jnrg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5EF0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8706
Entropy (8bit):	3.712403510044657
Encrypted:	false
SSDEEP:	192:R6l7wVeJXK26YEINQRegmf64vprG89bsHYfAEm:R6lXJa26YESQRegmf64ts4fC
MD5:	D28107F7C62201F8BA440494B06BB143
SHA1:	1E04FC28593B47692B834821748A6DAAC37F6AAD
SHA-256:	21621151F10EA14284E91990C6743DA5F614B526376F24BE64A375C4C0F60E6E
SHA-512:	29F125F778EDF6809EFCC463E154AB74AAC7A94090B172C64751EF05AD5C6842223A439D0702D2CE5C631DB1BCFC1542CFC56EA8A80DA8194F897EEAD31024DC
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F2F.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4889
Entropy (8bit):	4.562586354033417
Encrypted:	false
SSDEEP:	48:cvIwWl8zseJg771I9huWpW8VYV5Ym8M4JwsLmL+Fcayq85rSsDOrrsrxd:uIjfUI76P7VPJwVKbGOHCxd
MD5:	66396FB3B6C946C385B12E7FB8860177
SHA1:	3B420BE158A6EC364E54C2B1D430B5A559460CE0
SHA-256:	78F24759C9AA6D4141973FF45704FEF8E1C39E3D91972721DBBA81800825F4C5
SHA-512:	46A728577F990CC6729BFF763A8CB4AE8FF757C657B85C1D2997DCE7F21FEF054B90491C825D8DE45FB06E25AA1AFE58F8D98784BD7104E04D7EDDB9F04C32BC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="653819" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.12978795274488
Encrypted:	false
SSDEEP:	6:kKB39UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:8DnLNkPlE99SNxAhUe/3
MD5:	4B6AFBD170B053B0F48CFCD096F2EDCB
SHA1:	6B8BE71AD58025166C0F1A5B5561A9BB6BE0F7DE
SHA-256:	6A7030AEC8C69A7C9B64DE66AEEBF59F6828119C186CB52E268BAAC78E82CCCF
SHA-512:	144B20EE5828DA83E45274F43CF2B6F2A0FE6CEB8B64CEAC539461980F2BBBAAE56B657EF5996B466738F48DA68383E3727382980ADF92D90053975E0E132772
Malicious:	false
Preview:	p...... ........&../.Z..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_caigfzsp.5pi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_epbliuql.uib.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jk0pae3c.urc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wla0tx4j.13k.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421812029731737
Encrypted:	false
SSDEEP:	6144:sSvfpi6ceLP/9skLmb0OTfWSPHaJG8nAgeMZMMhA2fX4WABlEnNt0uhiTw:XvloTfW+EZMM6DFyf03w
MD5:	8B0FA514310216772ACAD0C69B19004D
SHA1:	42451151E296F84475DB8DB11A37AFA9A90D5656
SHA-256:	B37C8E05A261A77C8742CFED6A65D898EDFB3E8B0AB11E2934F3567B42D8A912
SHA-512:	C01BBEEA45AEEED45ADABB8FB2199033E9BF00CB2DB61C137A5E77A3FE0EA6E13A348CDF0B9932B60A5581FC24A3ADED3D5FD9CB7A398769C92C2D006C8814F2
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm~*\|+.Z..............................................................................................................................................................................................................................................................................................................................................y.k.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.994083100751873
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Payment-Order #24560274 for 8,380 USD.exe
File size:	401'408 bytes
MD5:	eac2017286abefbd21b28e7f9fcab248
SHA1:	02f90ba750bf3801e286ecfbf3467110f8b2ef94
SHA256:	e8f6dc455cea42a08feb8fcf5a34928864d537ec5ec905576cee58c9fabd6a5f
SHA512:	fa0a14b1bfce0fac1bbb1488f319dd864b9a94e784a6a637907d3bd31dddb80043de71ee582def13e72b9a4c2490c1738fa8d676feb3bc519d26bc75936db48b
SSDEEP:	12288:OaoO2yd67Jss86xlfLfC7hgooOK6YQMhUZC9WpVyi:OnV8gooOeQtrl
TLSH:	F78423296979738BD1CD29352E5C577E0EB0E0831C699BA7C9AC20CF4B1865A27C04FF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...._mg.........."...0.................. ....@...... .......................@............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x676D5FD5 [Thu Dec 26 13:53:25 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x5fec8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1d08	0x1e00	7c9ef85bddc8b801b9d922cc07e76a4b	False	0.6494791666666667	data	6.054758224594498	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0x5fec8	0x60000	dec1729b26e0ce2276a6bf6883b7499b	False	0.9974721272786459	data	7.99894639622686	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
STRONGER	0x42c8	0x180	data	1.0286458333333333
STRONGER	0x4448	0x10	data	1.5
STRONGER	0x4458	0x10	data	1.5625
STRONGER	0x4468	0x20	data	1.28125
STRONGER	0x4488	0x5f610	data	1.00032252119425
STRONGER	0x63a98	0x10	data	1.5625
RT_VERSION	0x63aa8	0x234	data	0.4734042553191489
RT_MANIFEST	0x63cdc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-30T10:57:06.198518+0100	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	91.223.3.156	8808	192.168.2.5	49709	TCP
2024-12-30T10:57:06.198518+0100	2030673	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)	1	91.223.3.156	8808	192.168.2.5	49709	TCP
2024-12-30T10:57:06.198518+0100	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	91.223.3.156	8808	192.168.2.5	49709	TCP
2024-12-30T10:57:06.198518+0100	2035607	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)	1	91.223.3.156	8808	192.168.2.5	49709	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 10:57:05.558496952 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:05.563328028 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:05.563405991 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:05.588167906 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:05.593024015 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:06.187407017 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:06.187424898 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:06.187480927 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:06.193691969 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:06.198518038 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:06.382208109 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:06.513112068 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:07.561430931 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:07.566265106 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:07.566319942 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:07.571114063 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.373191118 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.419379950 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:10.514110088 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.522412062 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:10.527244091 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.527296066 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:10.532125950 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.971013069 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.971285105 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.971362114 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:10.971375942 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.971395016 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.971407890 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.971420050 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.971431017 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.971441984 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.971451998 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:10.971453905 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.971513033 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:10.971513033 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:10.972074032 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.972085953 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.972096920 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.972129107 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:10.972161055 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:10.972400904 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.972441912 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.972455025 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.972486019 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:10.977066994 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.977078915 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:10.977119923 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.028759956 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.070936918 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.070957899 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.070971966 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.071017027 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.071029902 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.071029902 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.071043015 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.071072102 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.071111917 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.071537971 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.071573973 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.071585894 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.071599007 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.071613073 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.071618080 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.071625948 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.071654081 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.071676016 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.072206020 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.072302103 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.072316885 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.072329044 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.072340965 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.072348118 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.072352886 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.072371960 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.072405100 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.073184967 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.073198080 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.073209047 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.073220015 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.073235035 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.073247910 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.073251009 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.073262930 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.073307037 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.073996067 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.122488022 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.170191050 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.170222044 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.170236111 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.170248985 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.170259953 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.170296907 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.170356035 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.170453072 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.170466900 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.170480013 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.170494080 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.170495033 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.170510054 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.170523882 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.170542002 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.170564890 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.171201944 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.171214104 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.171226025 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.171242952 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.171256065 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.171256065 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.171268940 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.171284914 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.171295881 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.171299934 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.171346903 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.171973944 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.171987057 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.171998978 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.172013044 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.172024965 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.172030926 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.172039032 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.172043085 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.172050953 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.172063112 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.172075987 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.172080994 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.172121048 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.172854900 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.172867060 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.172879934 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.172893047 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.172907114 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.172919035 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.172919989 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.172954082 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.172971964 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.269737005 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.269805908 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.269859076 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.269861937 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.269896030 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.269932985 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.269953012 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.269961119 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.269977093 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.269992113 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.269999981 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.270009041 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.270024061 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.270035028 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.270042896 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.270081997 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.270504951 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.270517111 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.270528078 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.270540953 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.270553112 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.270556927 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.270570040 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.270585060 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.270596027 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.270596981 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.270612001 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.270632029 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.270670891 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.271131992 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.271186113 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.271198034 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.271209955 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.271224976 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.271255016 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.271430016 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.271569014 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.271580935 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.271593094 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.271604061 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.271609068 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.271615982 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.271626949 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.271639109 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.271644115 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.271651030 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.271662951 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.271672010 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.271692991 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.271723986 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.272537947 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.272550106 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.272561073 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.272573948 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.272587061 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.272600889 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.272608995 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.272612095 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.272619009 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.272624016 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.272631884 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.272644043 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.272666931 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.274981976 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.274993896 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.275007010 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.275031090 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.275063038 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.275548935 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.275698900 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.275710106 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.275722980 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.275733948 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.275743008 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.275746107 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.275758028 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.275762081 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.275770903 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.275784969 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.275794029 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.275798082 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.275811911 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.275846004 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.276130915 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.276141882 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.276154995 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.276165962 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.276180029 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.276185989 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.276186943 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.276199102 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.276209116 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.276233912 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.276257038 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.277528048 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.277539968 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.277551889 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.277600050 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.368923903 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.368942022 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.368953943 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.368998051 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369010925 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369021893 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.369023085 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369035959 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369052887 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.369062901 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369072914 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369092941 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.369105101 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369111061 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.369132042 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369185925 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.369200945 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369213104 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369255066 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.369282007 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369293928 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369307041 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369311094 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369323969 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.369369984 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.369391918 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369416952 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369458914 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.369481087 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369527102 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.369539976 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369550943 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369561911 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369604111 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.369755983 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369772911 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369786024 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369797945 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369801044 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.369816065 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369826078 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.369829893 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369842052 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369853020 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.369853973 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369867086 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369880915 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.369894028 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.369931936 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.370117903 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.370130062 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.370141029 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.370160103 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.370161057 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.370176077 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.370187044 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.370187998 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.370201111 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.370212078 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.370225906 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.370234013 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.370255947 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.370277882 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.370461941 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.370474100 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.370486021 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.370496988 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.370511055 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.370536089 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.374011993 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.374034882 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.374046087 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.374078989 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.374464035 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.374479055 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.374485016 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.374495983 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.374521971 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.374536037 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.374538898 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.374552965 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.374563932 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.374568939 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.374577045 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.374588966 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.374599934 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.374603987 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.374609947 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.374631882 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.374656916 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.468399048 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468419075 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468439102 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468451977 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468477011 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468487978 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.468488932 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468501091 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468513012 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468524933 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468543053 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.468553066 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468565941 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468568087 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.468576908 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468590975 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468602896 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.468620062 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.468641043 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468671083 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468704939 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.468739033 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468750954 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468761921 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468790054 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.468795061 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468803883 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.468852043 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468863010 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468877077 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.468921900 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.468921900 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.468943119 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469022036 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469033957 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469044924 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469057083 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469073057 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469085932 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469108105 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.469108105 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.469120979 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.469197989 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469253063 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469264984 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469266891 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.469305992 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.469364882 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469377995 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469388008 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469402075 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469412088 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.469414949 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469428062 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469439983 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.469440937 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469454050 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469466925 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469481945 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.469510078 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.469660044 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469671965 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469682932 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469710112 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469711065 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.469727039 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.469748020 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.469790936 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.473436117 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.473454952 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.473515034 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.473583937 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.473653078 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.473664045 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.473675013 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.473687887 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.473696947 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.473700047 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.473709106 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.473711967 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.473741055 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.473808050 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.473819017 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.473829031 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.473839045 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.473850965 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.473851919 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.473862886 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.473875046 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.473885059 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.473892927 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.473908901 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.473921061 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.473942041 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.473992109 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.474004030 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.474028111 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.474040985 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.474051952 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.474075079 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.474100113 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.474383116 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.474395990 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.474406958 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.474416971 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.474431992 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.474436998 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.474526882 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.528774023 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.567996979 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568044901 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568058968 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568069935 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568082094 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568099976 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568106890 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.568114042 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568130970 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568141937 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568147898 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.568152905 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568167925 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568167925 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.568182945 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568196058 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.568234921 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.568243027 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568253994 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568264008 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568274975 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568293095 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.568334103 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.568358898 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568444014 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568455935 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568468094 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568479061 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568485022 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.568490982 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568523884 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.568537951 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.568686962 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568697929 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568713903 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568726063 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568737030 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568741083 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.568748951 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568762064 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568766117 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.568808079 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.568820953 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568872929 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.568931103 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568943024 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568953991 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568969965 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568981886 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.568981886 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.568994999 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.569009066 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.569020987 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.569067001 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.569251060 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.569263935 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.569274902 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.569289923 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.569300890 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.569305897 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.569313049 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.569339037 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.572976112 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.572998047 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573010921 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573028088 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573048115 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573051929 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.573081017 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.573084116 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573096037 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573107958 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573121071 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573143005 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.573183060 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.573273897 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573420048 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573431969 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573446989 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573460102 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573467970 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.573471069 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573482990 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573494911 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573498011 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.573506117 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573518991 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573528051 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.573528051 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.573529959 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573544025 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573559999 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.573585987 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.573811054 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573899031 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573909998 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573921919 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573932886 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573946953 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573951960 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.573961020 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.573978901 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.574006081 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.668843031 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.668921947 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.668937922 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.668951988 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.668963909 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.668977022 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.668981075 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.668987989 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.668997049 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.668999910 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.669012070 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.669027090 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:11.669028997 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.669049025 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:11.669070959 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:12.344583035 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:12.349544048 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:12.349617004 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:12.354454994 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:12.455845118 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:12.497546911 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:12.582032919 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:12.638343096 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:19.439075947 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:19.443922997 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:19.445266962 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:19.450186014 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:19.772299051 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:19.825705051 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:19.920293093 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:19.922487974 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:19.927308083 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:19.927390099 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:19.932172060 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389290094 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389416933 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389430046 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389450073 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389477015 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.389518976 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.389549971 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389563084 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389575005 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389588118 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389600992 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389611959 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389617920 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.389633894 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.389668941 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.389708996 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389723063 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389789104 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.389815092 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389828920 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389839888 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389853001 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389863968 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.389864922 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389877081 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389889002 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389904022 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.389945030 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.389949083 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.389991999 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390028954 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.390033960 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390059948 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390078068 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390088081 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.390115023 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.390142918 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390155077 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390202045 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.390336037 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390347004 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390358925 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390369892 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390379906 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390391111 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390407085 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390408993 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.390419006 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390425920 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.390431881 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390441895 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.390444994 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390458107 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390466928 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.390499115 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.390669107 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390681028 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390692949 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390703917 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390727997 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.390748978 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.390753031 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390764952 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390775919 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390788078 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390794039 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.390799046 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.390834093 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.390863895 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.394309044 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.394329071 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.394346952 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.394381046 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.394419909 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.394435883 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.394448042 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.394474983 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.394504070 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.394510984 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.394519091 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.394610882 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.394630909 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.394644022 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.394656897 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.394668102 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.394684076 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.394695044 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.394728899 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.394774914 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.394788027 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.394825935 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.394912004 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.394951105 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.394961119 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.394973993 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.394999981 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.395006895 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.395019054 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.395025969 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.395028114 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.395101070 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.395723104 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.395735979 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.395747900 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.395760059 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.395770073 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.395773888 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.395782948 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.395812035 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.395823956 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.489346027 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489368916 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489425898 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.489464998 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489509106 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489521980 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489532948 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489562988 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.489588022 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.489588976 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489602089 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489614010 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489625931 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489638090 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489638090 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.489672899 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489674091 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.489686012 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489712000 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.489725113 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489794970 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489805937 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489818096 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489840984 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.489866972 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.489905119 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489917040 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489928961 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489938974 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489949942 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.489952087 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.489990950 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.490196943 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490207911 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490217924 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490228891 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490238905 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490248919 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.490250111 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490261078 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490272045 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490274906 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.490283966 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490294933 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490294933 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.490309000 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490319967 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.490346909 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.490489960 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490500927 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490513086 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490521908 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490540028 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.490559101 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.490593910 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490606070 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490617037 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490628004 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490638971 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490645885 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.490652084 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490664005 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490684986 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.490715981 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.490866899 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490875959 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490886927 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490897894 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.490941048 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.494230986 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.494240999 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.494287014 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.494911909 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.494935036 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.494946003 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.494956970 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.494967937 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.494976997 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.494980097 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.494987965 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.494997978 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.495007992 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.495009899 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.495023012 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.495027065 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.495033979 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.495044947 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.495045900 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.495060921 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.495071888 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.495078087 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.495084047 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.495095015 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.495106936 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.495136976 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.495136976 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.495150089 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.495162010 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.495172024 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.495186090 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.495215893 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.495419979 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.495491982 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.495502949 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.495513916 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.495524883 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.495553017 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.495567083 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.589271069 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.589282990 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.589329958 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.589482069 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.589493990 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.589504004 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.589519978 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.589533091 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.589543104 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.589545012 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.589557886 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.589581013 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.589596987 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.589612961 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.589624882 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.589634895 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.589664936 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.589669943 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.589677095 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.589688063 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.589695930 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.589721918 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.589761019 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.589772940 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.589808941 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.589967012 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.589979887 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.589991093 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590007067 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590018034 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590019941 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.590029001 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590034962 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.590042114 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590051889 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590065002 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.590065956 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590078115 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590090036 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590094090 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.590126991 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.590143919 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.590361118 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590372086 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590383053 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590394020 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590404034 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590414047 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590415001 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.590425968 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590436935 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590447903 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590450048 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.590459108 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590471029 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590480089 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590488911 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.590492010 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590502977 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590513945 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.590533972 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.590557098 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.590650082 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590694904 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590707064 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590733051 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.590739965 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.590779066 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.594135046 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.594151974 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.594198942 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.595097065 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595113039 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595125914 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595134974 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595146894 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595155954 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.595158100 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595170975 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595180988 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595185995 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.595192909 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595201015 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.595205069 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595216036 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595225096 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.595227003 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595246077 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595263004 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595268011 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.595274925 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595285892 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595287085 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.595298052 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595302105 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.595309973 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595325947 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595331907 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.595338106 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595352888 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.595372915 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.595429897 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595449924 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595460892 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595470905 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595482111 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.595491886 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.595513105 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.638250113 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.689275980 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689311028 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689342976 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689361095 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689363956 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.689392090 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689429998 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689441919 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.689474106 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.689480066 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689492941 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689532042 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.689573050 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689585924 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689595938 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689606905 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689625025 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.689630985 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689642906 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689654112 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689661026 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.689663887 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689676046 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689678907 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.689688921 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689699888 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689708948 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.689713955 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689728022 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.689764023 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.689892054 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689903975 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689915895 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689925909 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689935923 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689945936 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689948082 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.689956903 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689966917 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689975977 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.689979076 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.689990044 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.690002918 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.690005064 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.690026045 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.690037966 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.690216064 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.690253019 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.690268040 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.690293074 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.690327883 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.690403938 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.690414906 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.690427065 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.690437078 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.690447092 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.690457106 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.690458059 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.690470934 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.690479994 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.690486908 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.690493107 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.690505981 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.690531015 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.694175005 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694186926 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694199085 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694235086 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694242954 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.694278002 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.694684029 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694700956 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694711924 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694721937 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694732904 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694742918 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694750071 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.694755077 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694766045 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694776058 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694783926 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.694787025 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694799900 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694809914 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694820881 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694820881 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.694832087 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694844961 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694848061 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.694864988 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.694873095 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694885969 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.694886923 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.694955111 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.695290089 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.695307970 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.695324898 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.695334911 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.695346117 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.695357084 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.695358992 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.695369005 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.695380926 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.695414066 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.790340900 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790354967 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790365934 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790419102 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.790431976 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790451050 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790468931 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790474892 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.790482044 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790493965 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790522099 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.790541887 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790555000 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790566921 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790577888 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.790591002 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790596008 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.790632963 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.790659904 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790672064 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790683031 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790693998 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790704012 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.790740013 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.790749073 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790767908 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790810108 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.790854931 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790863991 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790874958 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790893078 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790899992 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.790904999 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790919065 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790930986 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790940046 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790946007 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.790952921 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.790977001 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.791076899 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791089058 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791100979 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791111946 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791136980 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.791167021 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.791198969 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791217089 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791229010 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791239977 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791249990 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791261911 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.791281939 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.791392088 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791403055 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791414976 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791425943 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791445017 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.791460991 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.791543007 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791554928 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791564941 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791575909 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791593075 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791594028 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.791604042 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791610003 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.791616917 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791627884 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791637897 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791647911 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.791657925 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.791686058 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.795295954 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.795320034 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.795335054 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.795386076 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.795749903 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.795763016 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.795783997 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.795794964 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.795806885 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.795825005 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.795840025 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.795862913 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.801372051 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.806199074 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:25.806260109 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:25.811103106 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296224117 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296468019 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296536922 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.296607971 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296627045 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296638012 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296672106 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296684980 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.296691895 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296704054 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296711922 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296736956 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296757936 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.296777964 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.296864033 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296875000 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296885967 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296896935 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296906948 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296916008 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.296917915 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296937943 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296948910 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296948910 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.296960115 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296968937 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.296973944 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296986103 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296997070 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.296999931 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.297027111 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.297036886 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297050953 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.297127008 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297178030 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297188997 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297214031 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.297239065 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.297245026 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297256947 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297266960 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297276974 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297297955 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.297323942 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.297415018 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297431946 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297442913 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297452927 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297463894 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297475100 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297482014 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.297486067 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297498941 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297502995 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.297509909 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297521114 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297523022 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.297532082 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297543049 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297549963 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.297554016 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297565937 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297576904 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297581911 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.297590017 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.297629118 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.297641993 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.301373005 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.301383972 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.301395893 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.301429033 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.301996946 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302012920 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302028894 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302038908 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302048922 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302057028 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.302059889 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302067041 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302072048 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302078009 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302081108 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.302083969 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302094936 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302104950 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302110910 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.302117109 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302126884 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.302129030 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302141905 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302151918 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.302154064 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302171946 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.302182913 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302191019 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.302196026 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302206993 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302225113 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.302253962 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.302479029 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302490950 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302500963 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302510977 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302520990 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302531004 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.302534103 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.302551985 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.302576065 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.396096945 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396167040 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396178961 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396198034 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396208048 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396219015 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.396226883 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396239996 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396251917 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396255016 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.396264076 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396272898 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.396277905 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396291018 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396303892 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396306992 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.396337032 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.396353006 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.396384001 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396440029 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396450996 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396481037 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396492004 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396502972 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396502972 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.396522045 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396533966 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396543980 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.396550894 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.396563053 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396583080 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.396590948 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396629095 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396640062 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396650076 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396678925 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.396764994 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396785021 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396796942 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396811008 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396821022 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.396862030 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.396903038 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396914959 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396927118 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396938086 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396949053 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396956921 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.396959066 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396971941 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.396974087 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.396986961 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.397016048 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.397169113 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.397181034 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.397192955 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.397202969 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.397209883 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.397216082 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.397227049 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.397253036 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.397268057 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.397301912 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.397316933 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.397329092 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.397365093 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.397403002 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.401154041 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401165962 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401176929 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401336908 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.401521921 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401540041 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401551008 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401561975 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401573896 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401583910 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401585102 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.401596069 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401607990 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401609898 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.401619911 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401628971 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.401632071 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401643991 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401662111 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401674032 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401684046 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401684999 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.401684999 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.401690960 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401696920 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401704073 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401707888 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.401734114 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.401768923 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.402110100 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.402121067 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.402132988 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.402143955 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.402154922 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.402162075 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.402175903 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.402194977 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.548268080 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.553010941 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:26.553997040 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:26.558790922 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:31.217066050 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:31.221992970 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:31.222269058 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:31.227061987 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:31.552014112 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:31.607112885 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:31.702086926 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:31.704381943 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:31.709245920 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:31.709336042 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:31.714200974 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:42.998738050 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:43.003921032 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:43.004007101 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:43.008781910 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:43.063308954 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:43.107187986 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:43.186191082 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:43.232182026 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:43.286103964 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:43.326003075 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:43.436495066 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:43.438605070 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:43.443479061 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:43.443535089 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:43.448277950 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:54.780103922 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:54.785010099 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:54.788289070 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:54.793101072 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:55.117094040 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:55.169790030 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:55.265389919 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:55.267560959 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:55.272357941 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:57:55.272416115 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:57:55.277276039 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:06.631186962 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:06.636023045 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:06.636077881 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:06.640922070 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:06.974473000 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:07.029299974 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:07.126116037 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:07.127964973 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:07.134006023 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:07.134077072 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:07.140275002 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:12.456521988 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:12.498121977 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:12.609286070 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:12.654429913 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:18.414937019 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:18.419784069 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:18.419836044 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:18.424599886 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:18.968297958 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:19.013844013 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:19.109462023 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:19.111382008 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:19.116195917 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:19.116266966 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:19.121093988 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:30.193808079 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:30.198662996 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:30.198715925 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:30.203497887 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:30.537774086 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:30.592225075 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:30.759553909 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:30.761416912 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:30.766140938 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:30.766195059 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:30.770948887 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:41.968298912 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:41.974149942 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:41.974247932 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:41.979072094 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:42.301037073 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:42.342179060 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:42.454118013 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:42.498311043 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:42.672614098 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:42.677454948 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:42.677495956 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:42.682344913 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:43.295866966 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:43.342073917 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:43.438241959 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:43.482719898 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:53.749382019 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:53.754196882 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:53.754271984 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:53.759053946 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:54.083760023 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:54.123457909 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:54.236356974 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:54.238019943 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:54.242834091 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:58:54.242981911 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:58:54.247828960 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:59:05.531088114 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:59:05.536010027 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:59:05.538964033 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:59:05.543812037 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:59:05.864547014 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:59:05.920361042 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:59:06.017198086 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:59:06.060990095 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:59:06.550209045 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:59:06.555073977 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:59:06.556931019 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:59:06.561757088 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:59:06.562949896 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:59:06.567794085 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:59:06.881705046 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:59:06.936041117 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:59:07.032651901 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:59:07.033480883 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:59:07.038378954 CET	8808	49709	91.223.3.156	192.168.2.5
Dec 30, 2024 10:59:07.038454056 CET	49709	8808	192.168.2.5	91.223.3.156
Dec 30, 2024 10:59:07.043287992 CET	8808	49709	91.223.3.156	192.168.2.5

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 30, 2024 10:57:03.942573071 CET	1.1.1.1	192.168.2.5	0xab60	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 30, 2024 10:57:03.942573071 CET	1.1.1.1	192.168.2.5	0xab60	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Dec 30, 2024 10:57:03.942573071 CET	1.1.1.1	192.168.2.5	0xab60	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Dec 30, 2024 10:57:03.942573071 CET	1.1.1.1	192.168.2.5	0xab60	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Dec 30, 2024 10:57:03.942573071 CET	1.1.1.1	192.168.2.5	0xab60	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Dec 30, 2024 10:57:03.942573071 CET	1.1.1.1	192.168.2.5	0xab60	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Dec 30, 2024 10:57:03.942573071 CET	1.1.1.1	192.168.2.5	0xab60	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Dec 30, 2024 10:57:03.942573071 CET	1.1.1.1	192.168.2.5	0xab60	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Dec 30, 2024 10:57:03.942573071 CET	1.1.1.1	192.168.2.5	0xab60	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Dec 30, 2024 10:58:06.003608942 CET	1.1.1.1	192.168.2.5	0x6a93	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 30, 2024 10:58:06.003608942 CET	1.1.1.1	192.168.2.5	0x6a93	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	04:56:58
Start date:	30/12/2024
Path:	C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe"
Imagebase:	0x24739600000
File size:	401'408 bytes
MD5 hash:	EAC2017286ABEFBD21B28E7F9FCAB248
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2278087509.000002473B566000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.2278087509.000002473B273000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000000.00000002.2278087509.000002473B273000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000002.2278087509.000002473B273000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:56:59
Start date:	30/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe" -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:56:59
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:56:59
Start date:	30/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:	0xb00000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.3303115562.00000000070C0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000002.3295095977.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000004.00000002.3295095977.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: 00000004.00000002.3302661683.0000000006E70000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.3302661683.0000000006E70000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: 00000004.00000002.3302661683.0000000006E70000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.3296787969.00000000031C8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000002.3296787969.0000000003191000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.3298836507.0000000004197000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	04:56:59
Start date:	30/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	04:56:59
Start date:	30/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7256 -s 1028
Imagebase:	0x7ff631c90000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:57:04
Start date:	30/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF848E7DF79 Relevance: 6.7, Strings: 4, Instructions: 1672
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^M_H, xrefs: 00007FF848E7DF8E
x6!K, xrefs: 00007FF848E7EC39
x6!K, xrefs: 00007FF848E7ED49
SM_H, xrefs: 00007FF848E7EA8E

Memory Dump Source

Source File: 00000000.00000002.2281283695.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e70000_Payment-Order #24560274 for 8,380 USD.jbxd

Similarity

API ID:
String ID: SM_H$^M_H$x6!K$x6!K
API String ID: 0-480365840
Opcode ID: 3673de42648fd481a41d09fad8a3bd8291710d895aa7a42b65bda4c410b42fc4
Instruction ID: da7f176154309ccba09c0742094ed88c254580bd1d2b89275cb6b7fd1dfa537c
Opcode Fuzzy Hash: 3673de42648fd481a41d09fad8a3bd8291710d895aa7a42b65bda4c410b42fc4
Instruction Fuzzy Hash: 8AB25630A0CB8A4FD359EB2884954B5B7E2FF95341F1446BEE48AC7296DF34E846C781

Function 00007FF848E70C48 Relevance: 4.5, Strings: 3, Instructions: 707
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M_H, xrefs: 00007FF848E73FDF
M_H, xrefs: 00007FF848E74363
d, xrefs: 00007FF848E7426F

Memory Dump Source

Source File: 00000000.00000002.2281283695.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e70000_Payment-Order #24560274 for 8,380 USD.jbxd

Similarity

API ID:
String ID: d$M_H$M_H
API String ID: 0-1879833558
Opcode ID: e98303f29c2ad483f66c0cab7c3342053370ac6aa3b7d8a6c7e24c0659034a92
Instruction ID: cde922be203b335a1d288476d60ca68d90db13c44b8031d74fdc77fed297090d
Opcode Fuzzy Hash: e98303f29c2ad483f66c0cab7c3342053370ac6aa3b7d8a6c7e24c0659034a92
Instruction Fuzzy Hash: 47225231A1CA8A4FE759EA2894815B177E1FF52358F1402B9D48EC7197EF38F842C785

Function 00007FF848F40060 Relevance: 3.5, Strings: 1, Instructions: 2245COMMON

Download Yara Rule

Strings

p7!K, xrefs: 00007FF848F41183

Memory Dump Source

Source File: 00000000.00000002.2281628279.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Payment-Order #24560274 for 8,380 USD.jbxd

Similarity

API ID:
String ID: p7!K
API String ID: 0-114164078
Opcode ID: a5b48f9c2fdc0729df00da224af4d0c4c7022bba83cc43df2d7ec3121f2aa233
Instruction ID: 13552fbf278584db5b86db3cf87473db09eb26da619756102538b90ebfca0cc5
Opcode Fuzzy Hash: a5b48f9c2fdc0729df00da224af4d0c4c7022bba83cc43df2d7ec3121f2aa233
Instruction Fuzzy Hash: EFE2477280DAC58FE796FB2888555A47FE0FFA6740F0805FBC489DB1D3EA286846C745

Function 00007FF848E87A40 Relevance: 2.4, Strings: 1, Instructions: 1155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 00007FF848E8E7F4

Memory Dump Source

Source File: 00000000.00000002.2281283695.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e70000_Payment-Order #24560274 for 8,380 USD.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 781fc91bde645e1a143144379929ee89bc7f8dc584178675a0b1a1ffad98457e
Instruction ID: 5ff5aacc783f45fd1f2779689baa8e3fa3fe6875730018d0ed84973c2b0e4a90
Opcode Fuzzy Hash: 781fc91bde645e1a143144379929ee89bc7f8dc584178675a0b1a1ffad98457e
Instruction Fuzzy Hash: 6582BF30E1CA4A8FEB58EB2888516B973E1FF55340F9445BDD45EC7292DF38B8428B85

Function 00007FF848E77F68 Relevance: 2.2, Strings: 1, Instructions: 927
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\M_H, xrefs: 00007FF848E7C9C4

Memory Dump Source

Source File: 00000000.00000002.2281283695.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e70000_Payment-Order #24560274 for 8,380 USD.jbxd

Similarity

API ID:
String ID: \M_H
API String ID: 0-2650405292
Opcode ID: 8a851b5ee4b3485dc1ab4583a82d8bf55051004757bdbac43dc14af20b8268a8
Instruction ID: 2c22879ca842166b2e6b42b183dd1234fa608d679b6d554e4acf202f48f3f921
Opcode Fuzzy Hash: 8a851b5ee4b3485dc1ab4583a82d8bf55051004757bdbac43dc14af20b8268a8
Instruction Fuzzy Hash: B652B330A1CA098FDBA8EA29D85567977E1FF59341F1401BEE44EC7292DF34AC428B85

Function 00007FF848E7B3F1 Relevance: 1.4, Instructions: 1436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2281283695.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e70000_Payment-Order #24560274 for 8,380 USD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d50b725aa4fca35279d084984841b66296b580ef615bb66f669ff3692db4fb8a
Instruction ID: 70cdfe791424fb4436ecf1fcee196bc3a169ddcba235c6d0c6f4a60c2659898d
Opcode Fuzzy Hash: d50b725aa4fca35279d084984841b66296b580ef615bb66f669ff3692db4fb8a
Instruction Fuzzy Hash: C3A2133091CB8A8FE359EB28C4944A5B7E1FF85345F1445BEE48AC72A6EF35E846C740

Function 00007FF848E73148 Relevance: 1.3, Instructions: 1304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2281283695.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e70000_Payment-Order #24560274 for 8,380 USD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b444e2012766c3330d98a48e5e3e27ac47fb2e36f71b338a954d71edc1001c3
Instruction ID: 17a2d233e0206dfb5454aa1e470376aad78c75c14eb6d7a0f096b40efb6cfbcb
Opcode Fuzzy Hash: 5b444e2012766c3330d98a48e5e3e27ac47fb2e36f71b338a954d71edc1001c3
Instruction Fuzzy Hash: 72624A2285EBDA4FE317AB745C650A07FB0EE23651B1E41EBC4C5CB1E3D61D684AC326

Function 00007FF848E7AF69 Relevance: .5, Instructions: 491COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2281283695.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e70000_Payment-Order #24560274 for 8,380 USD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1515ad13258c5a08305617228c77eaf033c5749570cbb3f903eaf9e7868d8d8
Instruction ID: 0cdd12f8ebb30d84e90c614543b169693694c3eea49c6de505397956833c7f1c
Opcode Fuzzy Hash: f1515ad13258c5a08305617228c77eaf033c5749570cbb3f903eaf9e7868d8d8
Instruction Fuzzy Hash: 80E1573190CB868FE319DB2884951B5B7E2FFD5341F1446BED48AC72A2DF38A846C785

Function 00007FF848E840A1 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2281283695.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e70000_Payment-Order #24560274 for 8,380 USD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7963fb376c667f49cc26102cfe7dca1e7a67e46b29315a5fd4bd9a2109b19ec
Instruction ID: 26f5a088b9dc60eec92ecf05a4b590dc9bf60392d62173765f51919e9dc00022
Opcode Fuzzy Hash: b7963fb376c667f49cc26102cfe7dca1e7a67e46b29315a5fd4bd9a2109b19ec
Instruction Fuzzy Hash: 4D41287190D78D4FD31EAA3488551BA7BA5EB82310F1582BFD086C7193DE28A8068396

Function 00007FF848E87AFA Relevance: 1.7, APIs: 1, Instructions: 195
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FF848E87C31

Memory Dump Source

Source File: 00000000.00000002.2281283695.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e70000_Payment-Order #24560274 for 8,380 USD.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6336e086681260962956995077aed7c2f04f5ad20809b1efc4e512940f09a8a1
Instruction ID: a3d487ac6fa715b52a20f8b8cd23c68bd576be0650cf06e3f8f94af58f3fba3d
Opcode Fuzzy Hash: 6336e086681260962956995077aed7c2f04f5ad20809b1efc4e512940f09a8a1
Instruction Fuzzy Hash: 09514931E0CA884FE718AA9DAC062BC7BE2FF95761F04427FD04893196DB3499468795

Function 00007FF848F410C9 Relevance: 1.5, Strings: 1, Instructions: 270
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p7!K, xrefs: 00007FF848F41183

Memory Dump Source

Source File: 00000000.00000002.2281628279.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_Payment-Order #24560274 for 8,380 USD.jbxd

Similarity

API ID:
String ID: p7!K
API String ID: 0-114164078
Opcode ID: 42440839f81d1f743ec0f5220d2f416ffb2d7b67646850190246b576fa8feca1
Instruction ID: ab4b834afaf74da83e8ffe79d22a2b74c0b083d275ef42de9fdb4bd12c219109
Opcode Fuzzy Hash: 42440839f81d1f743ec0f5220d2f416ffb2d7b67646850190246b576fa8feca1
Instruction Fuzzy Hash: FF71273190CAD94FEB56EB2888555B53BE0EF66B40F0901FBC04AD71D3EB19A846C395

Analysis Process: CasPol.exePID: 7400, Parent PID: 7256COMMON

Executed Functions

Function 06F321D8 Relevance: 22.2, Strings: 17, Instructions: 958COMMON

Download Yara Rule

Strings

c]q, xrefs: 06F32B42
c]q, xrefs: 06F32B38
$eq, xrefs: 06F32442
4c]q, xrefs: 06F324F7
$]q, xrefs: 06F32DFE
$]q, xrefs: 06F32E1C
heq, xrefs: 06F324C4
`]bq, xrefs: 06F32EDE
|b^q, xrefs: 06F32603
|b^q, xrefs: 06F325BE
c]q, xrefs: 06F326A5
4c]q, xrefs: 06F324ED
$]q, xrefs: 06F32E10
heq, xrefs: 06F3247F
|b^q, xrefs: 06F325F9
c]q, xrefs: 06F32B26
heq, xrefs: 06F324BA

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID: $eq$4c]q$4c]q$`]bq$heq$heq$heq$|b^q$|b^q$|b^q$$]q$$]q$$]q$c]q$c]q$c]q$c]q
API String ID: 0-2362020611
Opcode ID: d228005cbbbfa71ac221b53b7657ba6d4783b143c38be6508cd9e41e5de19d4e
Instruction ID: 76e601533f4dc66f31eebf31d5d12ca9c534ee9695118a8154722f9e9ee45086
Opcode Fuzzy Hash: d228005cbbbfa71ac221b53b7657ba6d4783b143c38be6508cd9e41e5de19d4e
Instruction Fuzzy Hash: EA927C74A00224CFDB64DF29C994A69BBF2FF88310F1585A9D84A9B365DB30ED81CF51

Function 02CAC518 Relevance: 8.2, Strings: 6, Instructions: 718COMMON

Download Yara Rule

Strings

Te]q, xrefs: 02CAC940
LIZh, xrefs: 02CAC7D2
4']q, xrefs: 02CACB6B
TJbq, xrefs: 02CAC5A1
paq, xrefs: 02CACBAA
xb`q, xrefs: 02CAC579

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: 4']q$LIZh$TJbq$Te]q$paq$xb`q
API String ID: 0-2814510443
Opcode ID: 7244b6d34ced77b3d6957e58b81b952287350c7847e073fd32fb9e75a4020145
Instruction ID: 51b5ccfe3d5ee22717433f4ebd2cf16b614bd5eef50e637f763ccd6c709dd090
Opcode Fuzzy Hash: 7244b6d34ced77b3d6957e58b81b952287350c7847e073fd32fb9e75a4020145
Instruction Fuzzy Hash: 20522675A00215DFCB15CF68C994EA9BBB2FF88304F1581A9E50AAB276CB31ED51DF40

Function 06F5B6A8 Relevance: 8.2, Strings: 6, Instructions: 708COMMON

Download Yara Rule

Strings

TJbq, xrefs: 06F5B728
xb`q, xrefs: 06F5B709
Te]q, xrefs: 06F5BAC7
4']q, xrefs: 06F5BCF2
paq, xrefs: 06F5BD31
LIZh, xrefs: 06F5B959

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID: 4']q$LIZh$TJbq$Te]q$paq$xb`q
API String ID: 0-2814510443
Opcode ID: 14936f8008250127d4048b836efff44c998f80466b81b80eda99c7b220e135fa
Instruction ID: 0bdf0a630652cc57591e5da71aecebe43ffb97fc598960600d822c66dabf3311
Opcode Fuzzy Hash: 14936f8008250127d4048b836efff44c998f80466b81b80eda99c7b220e135fa
Instruction Fuzzy Hash: C0523875A00515DFDB59DF68C994E99BBB2FF48300F1681A8EA09AB276DB31EC41CF40

Function 06F5B6AA Relevance: 5.3, Strings: 4, Instructions: 307COMMON

Download Yara Rule

Strings

TJbq, xrefs: 06F5B728
xb`q, xrefs: 06F5B709
Te]q, xrefs: 06F5BAC7
LIZh, xrefs: 06F5B959

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID: LIZh$TJbq$Te]q$xb`q
API String ID: 0-2805892111
Opcode ID: 832e95c74510b7d3c82a9d12ef73ee6018b0b18ed25e887b1c6a15e3f5682c90
Instruction ID: 89abdf95c08e6d3746c5eb453cd5792d3f16ab94d4b8bf3f3a8e230c853e2884
Opcode Fuzzy Hash: 832e95c74510b7d3c82a9d12ef73ee6018b0b18ed25e887b1c6a15e3f5682c90
Instruction Fuzzy Hash: 82C14771E002199FCB54DFA9C994BADBBF2BF88300F1581A9E919EB255DB30AD41CB50

Function 06F5B33B Relevance: 2.7, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

4']q, xrefs: 06F5B417
4']q, xrefs: 06F5B3EC

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 8089ccae86133d586cf528314e2e2f16e8ea01b9a390e720c1fbf5d946efa876
Instruction ID: 744892d57ad775669f37bffc364ddeb367151fa43de6985369a9a3815ee660db
Opcode Fuzzy Hash: 8089ccae86133d586cf528314e2e2f16e8ea01b9a390e720c1fbf5d946efa876
Instruction Fuzzy Hash: FE612C70A1020A8FD708EF6BEA9069ABBE7FFC9300B14C539D1449B264DF785D45CBA1

Function 06F5B348 Relevance: 2.6, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

4']q, xrefs: 06F5B417
4']q, xrefs: 06F5B3EC

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 60db2757d3ab91ba5d6a31eeca9984ce92821680ba6b976a87981ce9cc2c2c64
Instruction ID: 7af2a210e4904ab780d3ceb5fdb49e285fb678f684b71c700e389617379ac096
Opcode Fuzzy Hash: 60db2757d3ab91ba5d6a31eeca9984ce92821680ba6b976a87981ce9cc2c2c64
Instruction Fuzzy Hash: F051E970A5020A8FD748EF6BEA9069ABBE7FFC9300B14C539D1049B268DF785945CB91

Function 02CA5CF0 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\VBm, xrefs: 02CA5FA7

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: \VBm
API String ID: 0-971115878
Opcode ID: 8ee7ef444552f44e5c701cb953379c6af8e63371a0dcb7a2bb26cf78d29e94db
Instruction ID: 6b636ba2e394d639b35f7d5624384650336c38911ace1ffd123e5fad7adf98af
Opcode Fuzzy Hash: 8ee7ef444552f44e5c701cb953379c6af8e63371a0dcb7a2bb26cf78d29e94db
Instruction Fuzzy Hash: 31B17EB0E0020ACFDF10CFA9C9957AEBBF2AF88348F54C129D815A7254EB359945CF85

Function 06F3CEA0 Relevance: .7, Instructions: 719COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa294b0b69a963ac65ead23861d55b2a166b094031af2649a15ddfd159b89256
Instruction ID: 27b4803c456fb75c3e9fef18106254294ab169414bd26921f50fc1019d777f36
Opcode Fuzzy Hash: fa294b0b69a963ac65ead23861d55b2a166b094031af2649a15ddfd159b89256
Instruction Fuzzy Hash: 77626830A00215CFCB55DF68D584A6AFBF6FF88300B158A69E54A9B366DB30FC41CB90

Function 06F3E2A0 Relevance: .6, Instructions: 640COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 319d835737e5d2974a2541bb8bf8cdab9fb5fb5e3c4e7afb721090b97fe44814
Instruction ID: 7234f6b8cd6e957a5231e3a7d1ed73a424b7695e9218b598268f91840b9b0a60
Opcode Fuzzy Hash: 319d835737e5d2974a2541bb8bf8cdab9fb5fb5e3c4e7afb721090b97fe44814
Instruction Fuzzy Hash: 2D425970B00215CFDB95DF68C594AAEBBF6BF89300F14846AE5469B3A5DB34EC41CB90

Function 06F38B58 Relevance: .6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed0973eef68abbdb6eb6c68f55e767d7749e20d9d8edebfa795b502b5c5b44ab
Instruction ID: 8086e3ef4b234b5974ccffb1d925b6f5db7748d7c1ca4cdb2e5e8ac74a704571
Opcode Fuzzy Hash: ed0973eef68abbdb6eb6c68f55e767d7749e20d9d8edebfa795b502b5c5b44ab
Instruction Fuzzy Hash: 1E428870E00721CFDB64CF39C94866ABBF6BF84355F144469E1168B3A4EBB9E881CB50

Function 06F5E377 Relevance: .5, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2855b7a2afda5b51868e3b7bda3adc453cf83a261215d63137298434f43caac3
Instruction ID: bf904d8d97628342ab39d4e70f6d4c305f2cd94c458bbac429e9abc9e0788e78
Opcode Fuzzy Hash: 2855b7a2afda5b51868e3b7bda3adc453cf83a261215d63137298434f43caac3
Instruction Fuzzy Hash: 14221C74A012199FCBA5DF28C984A99B7F6FF88310F1581D9D94AAB354DF34AE81CF40

Function 06F3B3D8 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8804822b85df675678c26448763a8069076eb1e42c449006f91390df68d34f00
Instruction ID: 13fe13813e4f0b992730cd852d1d3eeaea33d44b7d906b8d39ef88f408542277
Opcode Fuzzy Hash: 8804822b85df675678c26448763a8069076eb1e42c449006f91390df68d34f00
Instruction Fuzzy Hash: 2A026935E04716CFDBA5CF69C594A6ABBF2FF98300F148569E44A8B762D734E841CB40

Function 06F36A08 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0efdd83386c40f7308566de28fa06b4ff7b5593c8bb4bafe18c3f7694d2cc62e
Instruction ID: fbdf71795f6a2f92fa940844bc6561f9cea91514f537d4d2ad0802e204d532f5
Opcode Fuzzy Hash: 0efdd83386c40f7308566de28fa06b4ff7b5593c8bb4bafe18c3f7694d2cc62e
Instruction Fuzzy Hash: E1F16A30E00209DFDB48DFA4D894AADBBB6FF88304F148569E906AB359DB34DC45CB50

Function 02CA65C0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67f901e77d24271b4d14925e7f7aa88b4b99c63798d3ac08a03cceea576f51f
Instruction ID: f4e6213d1eb37304b97c2b3ca65f5bba03ef185b07a26cd0553bdbf5fa544463
Opcode Fuzzy Hash: b67f901e77d24271b4d14925e7f7aa88b4b99c63798d3ac08a03cceea576f51f
Instruction Fuzzy Hash: 44B16F70E1020ACFDF14CFA9C9957ADBBF6AF88318F288129D815E7254EB749945CF81

Function 02CA1733 Relevance: 4.2, Strings: 3, Instructions: 439COMMON

Download Yara Rule

Strings

a]q, xrefs: 02CA1CDF
xaq, xrefs: 02CA1D76
a]q, xrefs: 02CA1D3C

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: a]q$ a]q$xaq
API String ID: 0-315583803
Opcode ID: f82e90926311f70d33c532314bfccbf3415f9b62eb76bab3dc1a873903b006d0
Instruction ID: cb7f381c853df2f79ca68ec84ce6a16b3b31de4b2441269e374ff1c00eae1d92
Opcode Fuzzy Hash: f82e90926311f70d33c532314bfccbf3415f9b62eb76bab3dc1a873903b006d0
Instruction Fuzzy Hash: 4002BE70B002059FD714DF69D494B6A7BE6FF88308F148A68D4169F3A4DFB89D86CB81

Function 02CA1962 Relevance: 3.9, Strings: 3, Instructions: 183COMMON

Download Yara Rule

Strings

a]q, xrefs: 02CA1CDF
xaq, xrefs: 02CA1D76
a]q, xrefs: 02CA1D3C

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: a]q$ a]q$xaq
API String ID: 0-315583803
Opcode ID: fe420fef2b3398d04d19e19d750d72ec735165aa92e6b01b943ab6538825d5de
Instruction ID: 983347af00bb8489cd1e59564d074c18e9b521ae9cea8b4ebd7e0d1585c52d84
Opcode Fuzzy Hash: fe420fef2b3398d04d19e19d750d72ec735165aa92e6b01b943ab6538825d5de
Instruction Fuzzy Hash: AD61A970B002059FD314DF69D4A4B6A7BE6FF88708F148A68D5069F3A8DFB59D46CB80

Function 02CA0EBA Relevance: 3.9, Strings: 3, Instructions: 161COMMON

Download Yara Rule

Strings

(aq, xrefs: 02CA1192
Te]q, xrefs: 02CA0EED
d6p, xrefs: 02CA0F05

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: (aq$Te]q$d6p
API String ID: 0-967301506
Opcode ID: 3654918e89078a8ce2eaaf47d8e165199ae3d05fd644453bc30a6f6d79a75021
Instruction ID: 44218dc93981e769e9ca796ffb26c925ce7749e007a49d834f73e23faa06c9af
Opcode Fuzzy Hash: 3654918e89078a8ce2eaaf47d8e165199ae3d05fd644453bc30a6f6d79a75021
Instruction Fuzzy Hash: 86516E30B101158FC754DF69C494AADBBF6FF89710F2581A9E806DB3A5CB75DC028B80

Function 06F53348 Relevance: 3.3, Instructions: 3315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1b6cdc0e01449c1bd72becb463260a872e26c2cf7a0fa253957f724de9313e6
Instruction ID: 3064636a05c558e398aec1d5590ce8c31090d733ee806fe1a9cd7b1fb3d56043
Opcode Fuzzy Hash: a1b6cdc0e01449c1bd72becb463260a872e26c2cf7a0fa253957f724de9313e6
Instruction Fuzzy Hash: 9C637B70A4022E9FEB659B50CC95BEEBB7AFB84701F104099E70A6B3D0DA755E80CF54

Function 06F5D600 Relevance: 3.3, Strings: 2, Instructions: 796COMMON

Download Yara Rule

Strings

$]q, xrefs: 06F5D8B5
2, xrefs: 06F5DDDA

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID: 2$$]q
API String ID: 0-351713980
Opcode ID: 3fb2566e99209dc8e91a26648238dfdbff87b15e2d549cb6537eb04bdd61b06b
Instruction ID: d4c96a4f5f67f5352abcec4a8f9ee20a7730de5bf51ed31125debc368f334e92
Opcode Fuzzy Hash: 3fb2566e99209dc8e91a26648238dfdbff87b15e2d549cb6537eb04bdd61b06b
Instruction Fuzzy Hash: E7821874A0121A8FCBA4EF69D994B997BF2FF89300F1085A9D90AD7354DB389D85CF40

Function 06F51230 Relevance: 2.9, Strings: 2, Instructions: 405COMMON

Download Yara Rule

Strings

,aq, xrefs: 06F515F5
,aq, xrefs: 06F515E1

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID: ,aq$,aq
API String ID: 0-2990736959
Opcode ID: a759701e90e8898b056f6e6a81ec6123a9a8e688b11718abe797e4c08467c553
Instruction ID: 951314a831da33e1cb21ba82e9cd60fd2dad84b16d6f66281604af7394bcf084
Opcode Fuzzy Hash: a759701e90e8898b056f6e6a81ec6123a9a8e688b11718abe797e4c08467c553
Instruction Fuzzy Hash: BAE13C34B105018FCB58DF7EC594A2A77EABF8961471681A9EA0ACB375EF74EC01CB40

Function 02CA9E10 Relevance: 2.7, Strings: 2, Instructions: 213COMMON

Download Yara Rule

Strings

[, xrefs: 02CAA02E
xaq, xrefs: 02CAA156

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: xaq$[
API String ID: 0-3815502426
Opcode ID: 387e8553c30e1f26b3bcc5cacdce4b72f3a486a00bbaf0499d4b4df1883c0c51
Instruction ID: fe1244f4222cd7b3346dad1e4375690c92fd16aed41c82abb3fb07374d084144
Opcode Fuzzy Hash: 387e8553c30e1f26b3bcc5cacdce4b72f3a486a00bbaf0499d4b4df1883c0c51
Instruction Fuzzy Hash: 2D918FB0A00206CFD724CF29E9647553BB6F788B1DF08462ACA118BBA8D7759B45CFD1

Function 02CA0D20 Relevance: 2.6, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

Haq, xrefs: 02CA0E40
dLcq, xrefs: 02CA0D5B

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: Haq$dLcq
API String ID: 0-1713614415
Opcode ID: 4a5c33d415e0738b55aa6c5c45c984b792c343931f65b9304239781a6cee2340
Instruction ID: 1016a7fa7214884d7beeab3ad15c63526bac6f21311522aa2e6999ddd70267ee
Opcode Fuzzy Hash: 4a5c33d415e0738b55aa6c5c45c984b792c343931f65b9304239781a6cee2340
Instruction Fuzzy Hash: 6751D031B002058FDB188F68D494AAEBBF6FF89304F1445AAE445DB362CB399C05CB90

Function 02CA9278 Relevance: 2.6, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

$]q, xrefs: 02CA92B7
$]q, xrefs: 02CA92AD

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: a746b2d9bfe0a9a2dddc9964a3320fe3caaccd0fc779a5c3a837decb17599a3a
Instruction ID: 80f838825cff863a236e40d201537ba3233eaa6cbe644a8357dc7e561728911a
Opcode Fuzzy Hash: a746b2d9bfe0a9a2dddc9964a3320fe3caaccd0fc779a5c3a837decb17599a3a
Instruction Fuzzy Hash: 09415F30709406DBC7285F6A90AA92DBBB6FFC47097288955E14A8B3D8CF35DD13CB85

Function 06F31218 Relevance: 1.6, Strings: 1, Instructions: 371COMMON

Download Yara Rule

Strings

d, xrefs: 06F31527

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: b477b5f1e44f43f1f8717e36149917e385a107f24f90d98446c96c3557642105
Instruction ID: 6268cfb1238f23a3c4ec4f68a1b7ade4576bc1cb66ccf60c2c28238fd32810c4
Opcode Fuzzy Hash: b477b5f1e44f43f1f8717e36149917e385a107f24f90d98446c96c3557642105
Instruction Fuzzy Hash: F7E1CE31604612CFC711CF19C980C5AFBF6FF8531075ACAAAE55A8B6A5D730F855CB90

Function 06F3FA60 Relevance: 1.6, Strings: 1, Instructions: 351COMMON

Download Yara Rule

Strings

Hb^q, xrefs: 06F3FAB3

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID: Hb^q
API String ID: 0-932020720
Opcode ID: 17bb1de1eb19f071ae09ed33146d7ca8a392adb22a739df0b1b7e3450ef45b49
Instruction ID: 384723b082b531c0ab570ef51fa2afd5b1554a45bf50e23aa37f6f7ab6488f04
Opcode Fuzzy Hash: 17bb1de1eb19f071ae09ed33146d7ca8a392adb22a739df0b1b7e3450ef45b49
Instruction Fuzzy Hash: 3EE17B74A01219DFCB44DF68D894E9EBBF6FF88310B1585A9E8059B362DB30ED45CB90

Function 02CA5CE4 Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

\VBm, xrefs: 02CA5FA7

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: \VBm
API String ID: 0-971115878
Opcode ID: 83510c426376c6128d62de30a900e87f356d1bb7e8dfad45b1d83d4599b51f5a
Instruction ID: b75d8916de2a02c577ceea64eb48192fa6823c87c24d3ae2ce646f1b29f97655
Opcode Fuzzy Hash: 83510c426376c6128d62de30a900e87f356d1bb7e8dfad45b1d83d4599b51f5a
Instruction Fuzzy Hash: 45B16DB0E0020ACFDF10CFA8C99579EBBF2EF88358F648129D815A7254EB359945CF95

Function 02CA2DA8 Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

./\, xrefs: 02CA2DD8, 02CA2FD4

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: ./\
API String ID: 0-3176372042
Opcode ID: 5011a45628a819fc38b76770a7a127c72ed061d2b9e1a0786aeb1af4e3f7ddf8
Instruction ID: 9974818c879754a0c185546fd8493d1b86e55af3f76be3b124e1f9c46d505b0a
Opcode Fuzzy Hash: 5011a45628a819fc38b76770a7a127c72ed061d2b9e1a0786aeb1af4e3f7ddf8
Instruction Fuzzy Hash: 5391ED30A002268FCB15DF68C89069EFBB6FF84314F1486A9D819AB355DB35ED46CBD1

Function 073E6248 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

Ddq, xrefs: 073E62D7

Memory Dump Source

Source File: 00000004.00000002.3303458791.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_CasPol.jbxd

Similarity

API ID:
String ID: Ddq
API String ID: 0-562783569
Opcode ID: 37f774b5c5c53d2051b3b4a0a971c5cb047a218c293a3862380359e6ce448302
Instruction ID: 534e8b27a895240f293b45f971ec50423efac4a9fbfc638f8f57dc18fc75b69c
Opcode Fuzzy Hash: 37f774b5c5c53d2051b3b4a0a971c5cb047a218c293a3862380359e6ce448302
Instruction Fuzzy Hash: D481CCB0600212DFD714DF29D594A6ABBFAFF88310F1584A9D059AB3A1DF35EC41CB91

Function 06F574C0 Relevance: 1.4, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

T, xrefs: 06F57603

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID: T
API String ID: 0-373082590
Opcode ID: e37bfd9ff514ace8632cd30039dbde0e8e314e5ffbc90d85a8e4b83e321c7fca
Instruction ID: 3c39db0048bdb057204d36bf2a870b7da8d0afe13fd264dd037e363ecef98c77
Opcode Fuzzy Hash: e37bfd9ff514ace8632cd30039dbde0e8e314e5ffbc90d85a8e4b83e321c7fca
Instruction Fuzzy Hash: F1617E30B002058FCB54EF68D594AAEBBF6EF89310F158569E906EB3A1DB35DC45CB90

Function 02CAFD80 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

d, xrefs: 02CAFECC

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 99088f8eb5f139c009c95ca4c03eeff3358189d392bdc7fdbc4fc145ca57f15b
Instruction ID: ba1bc331eb0ed79353c27328877a12b40467eb317bb9048cd7c26565e7fddcb4
Opcode Fuzzy Hash: 99088f8eb5f139c009c95ca4c03eeff3358189d392bdc7fdbc4fc145ca57f15b
Instruction Fuzzy Hash: 85617730A006068FCB24CF59D4C08AAFBF6FF88314750C66AD9599BA15EB35FD51CBA0

Function 06F3E0E8 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

@, xrefs: 06F3E252

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 182a563bce8e9a63ab50f277c9ad4979f2f3c5e2387688420d8e3215f8d87475
Instruction ID: 70af5271d7b7f1d5b10893d55e1c2d26850e4cfdbc14075941ad508255c33566
Opcode Fuzzy Hash: 182a563bce8e9a63ab50f277c9ad4979f2f3c5e2387688420d8e3215f8d87475
Instruction Fuzzy Hash: 31517975E00229DFDB55CFA9C984AAEBBB6FF88310F14806AE905AB355D730DD44CB90

Function 06F5F161 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

TJbq, xrefs: 06F5F1B9

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID: TJbq
API String ID: 0-1760495472
Opcode ID: 20e0695be13598875d7bec606767334ec372f5d70501a1b40ddea98527fe1b95
Instruction ID: acf0cd304cf37a4d08663660b5762093225947ccd1b8289f866b760122890416
Opcode Fuzzy Hash: 20e0695be13598875d7bec606767334ec372f5d70501a1b40ddea98527fe1b95
Instruction Fuzzy Hash: A8512D347241458FD351AB29D8947AB37A7EFDA220F144169CA46CB3C8CE389C86CBC2

Function 06F50CD0 Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

4']q, xrefs: 06F50D5C

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: a529553a17e67a4eb7f777f287010f8a7ad9436517277285c9533a8b6d2fd70e
Instruction ID: f67237fd33c76aa3ae0c3c873b6d06846d21bd715e5a859ca69704912d76d005
Opcode Fuzzy Hash: a529553a17e67a4eb7f777f287010f8a7ad9436517277285c9533a8b6d2fd70e
Instruction Fuzzy Hash: 7751B071A00305DFC749DF28C58089ABBF6FF89314B158AA9D4598B326DB30ED45CBA0

Function 06F50CE0 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

4']q, xrefs: 06F50D5C

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 8996344cedf536ad5f221e8ca1df2edc74b0421fd917138c5b489ef07d4c75a0
Instruction ID: 0143e08e271eccc5e75fc33be580c7452d0d9d299d9d0bc8be1671a80ced6d02
Opcode Fuzzy Hash: 8996344cedf536ad5f221e8ca1df2edc74b0421fd917138c5b489ef07d4c75a0
Instruction Fuzzy Hash: 3151AD74A00306DFC748DF69C58089EBBF6FF88314B158AA9D4599B326DB30ED45CB90

Function 02CA9BB8 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

Te]q, xrefs: 02CA9C56

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: d6ab51e6e2d7cc5e6d2ad483cfe0cbb38ca34e675481e603a5a2b123cf04718e
Instruction ID: 99dc21854aaa5db42927c25edae548d685bddd0fad68a4c9c84d9dd329f32d5c
Opcode Fuzzy Hash: d6ab51e6e2d7cc5e6d2ad483cfe0cbb38ca34e675481e603a5a2b123cf04718e
Instruction Fuzzy Hash: 89515C70A40605DFE714DF6AD969B69BBB1FF88718F204159E5129B3E0CB75AC81CB40

Function 02CA9261 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

$]q, xrefs: 02CA92AD

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: f9b708ca39778ef7b754884b066f0af8d1e05bebbc1cf289c3edb48952babc49
Instruction ID: 4f13faaefffd1c3ca1f7080ed06464e2a26e3a15feb99c730693a764cc5c55ea
Opcode Fuzzy Hash: f9b708ca39778ef7b754884b066f0af8d1e05bebbc1cf289c3edb48952babc49
Instruction Fuzzy Hash: A841A030609406DBC7291F6A90AA52DBBB7BFC47097388955E14A8B3D8CF35DC13CB81

Function 02CA1339 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

LR]q, xrefs: 02CA138B

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 2e6925787f11d886261ccfc77a4154624bd1df99d2da557f9421ac3fd6fd2f5d
Instruction ID: 2fc134bd66adb75a416bd48db1b3a921f446bfe9ad52c85072ea9c0866696b32
Opcode Fuzzy Hash: 2e6925787f11d886261ccfc77a4154624bd1df99d2da557f9421ac3fd6fd2f5d
Instruction Fuzzy Hash: AD31BC70F012169FCB449B798560A6EBBF6BFC9214B184069E04ADB360EE74DD028B91

Function 02CA0D10 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

dLcq, xrefs: 02CA0D5B

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: dLcq
API String ID: 0-2236789282
Opcode ID: a0efae36a695f3c805055221bdd56c8ff9c0b917d7557e87f342f8b37531995b
Instruction ID: 3614c79ab41216bd38b790796374ff56387238f5bdc851bbbaf79d620413da37
Opcode Fuzzy Hash: a0efae36a695f3c805055221bdd56c8ff9c0b917d7557e87f342f8b37531995b
Instruction Fuzzy Hash: 63319E31A002058FDB18DF69C498BAEBBF6FF88304F148569E446AB361CB75ED45CB91

Function 06F3E0D9 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

@, xrefs: 06F3E11A

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 8259698ca47320eca84948241a4732b77f7e177a73c53a590c6416b27b4f20e6
Instruction ID: 2741e1e55a6d08a2c7e1fb0f8538999ab240cd1405a0f608de83d55d230ed6e8
Opcode Fuzzy Hash: 8259698ca47320eca84948241a4732b77f7e177a73c53a590c6416b27b4f20e6
Instruction Fuzzy Hash: 6B219472A002299FDB55DFA9D8849EE7BB9FF49310B04806AE544D7215D730DA41CB90

Function 02CA8CC8 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

LR]q, xrefs: 02CA8CED

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 4b1a5b783a5c951feb03106387c80d40321ec9408959087b4fbc147d6449e8fb
Instruction ID: 50eb4350f873d8ad8c1729e4757b6e61d15cb68048bc4318dd3baeca0b1cc383
Opcode Fuzzy Hash: 4b1a5b783a5c951feb03106387c80d40321ec9408959087b4fbc147d6449e8fb
Instruction Fuzzy Hash: DC01D672F001069FCB04DBB8D9227AD77F1FF44605F1041A9D106DF250E6309E058BC1

Function 02CAA67D Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

Te]q, xrefs: 02CAA6AB

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 9fb12f17fbf643f0b134bfd2fb8933f673856cd16d98a46eae992013bca0ab04
Instruction ID: 04d6868705c23e683f3cbb91e88615693de982c71895a023afe8fe6ababbbba8
Opcode Fuzzy Hash: 9fb12f17fbf643f0b134bfd2fb8933f673856cd16d98a46eae992013bca0ab04
Instruction Fuzzy Hash: F621A871B001068FD7149F698465BAEBAF7ABC8710F64841AE502EB3A4DEB48C06CB90

Function 02CA9190 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

Te]q, xrefs: 02CA91AA

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: b021f1d6f69ced3fde69a214361cd77e7ab354e841ea0f348a14cc3bc049f9a9
Instruction ID: 7c21338f8c75b012f35bc257bd6776647ef1bfb0d9ca2f910b1733721e6887de
Opcode Fuzzy Hash: b021f1d6f69ced3fde69a214361cd77e7ab354e841ea0f348a14cc3bc049f9a9
Instruction Fuzzy Hash: F62190317101158FDB189F68C869BAE7BF6AF88B14F244259E502DB3B0CF758C05CB91

Function 02CA3321 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

|, xrefs: 02CA3380

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 384906c37008a11038cd340c068241f3f428a81ff4cec90abbf0489042e524d0
Instruction ID: a414282fb1b8e4b8600b41748bc5455fffe16aa07d6d10b7a4a7e3d052a6f327
Opcode Fuzzy Hash: 384906c37008a11038cd340c068241f3f428a81ff4cec90abbf0489042e524d0
Instruction Fuzzy Hash: B911AC71B402159FDB409F78C925B6E7BF1AB8C614F1084AAE60AE73A0DB34AD01CB81

Function 02CAA690 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

Te]q, xrefs: 02CAA6AB

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 987b759ecb9e56d7f4030c2dacd6377179d3736b100a146783692389036c99f5
Instruction ID: 3cbbaffca2cf53ab88c3d5ca1f0c84d7dd4f4abb173db168e6812297ed01ad3d
Opcode Fuzzy Hash: 987b759ecb9e56d7f4030c2dacd6377179d3736b100a146783692389036c99f5
Instruction Fuzzy Hash: 7B116670B001058FD7149F69C4A5BAEBAF7BFC8714F244419E502EB3A4CEB49C06CB90

Function 02CA9697 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

Te]q, xrefs: 02CA96C3

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: b56bbac61ba7238e547bed3ff6d5b35eb7cb01e263470d6e4b981ff5da396242
Instruction ID: 311adae170d2a85ea764338c37c480fb7d2af48abb0869cbb1997d90ddc98faa
Opcode Fuzzy Hash: b56bbac61ba7238e547bed3ff6d5b35eb7cb01e263470d6e4b981ff5da396242
Instruction Fuzzy Hash: F2119370B50201CFDB149F68C4A6B6DBBF6AF88714F14445AE502EB3B5CA719C45CB50

Function 02CA96A8 Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

Te]q, xrefs: 02CA96C3

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: cac000aaf1d2216f85af0d08533a4f65bc4c943b24dd8807f113a501d725af1a
Instruction ID: 2459ee21aab90c88e4bf41b72823419ed6efc7e8ca03f413f26c9c0c74068eda
Opcode Fuzzy Hash: cac000aaf1d2216f85af0d08533a4f65bc4c943b24dd8807f113a501d725af1a
Instruction Fuzzy Hash: EB118F70B40105CFDB149F29C4A9B6EBBE6AF88714F144059E902EB3A5CE719C41CBA0

Function 02CAA5D0 Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

Te]q, xrefs: 02CAA5FD

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 72f3536b94cfa35aa6289ebdb06e27ef06b8e9082cef0541e91cb2497172b4be
Instruction ID: 48faff4a360183950b1daf48d196de6912da50e294fe0ebbf5847180bb9dede0
Opcode Fuzzy Hash: 72f3536b94cfa35aa6289ebdb06e27ef06b8e9082cef0541e91cb2497172b4be
Instruction Fuzzy Hash: 7211E171B101059FDB149B58C86ABAE7BF6EF8C711F2400A9E402E73A0CF759D05CB91

Function 02CA0E3F Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

Haq, xrefs: 02CA0E40

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: e28a23dad2de312034e2db37e420e6421f631bfb1b252fe8ad199faff0a262cf
Instruction ID: 9b51eef51f36ff0a253cb66b7b5af11298991f1deb21178c57a2b463c18fbfd2
Opcode Fuzzy Hash: e28a23dad2de312034e2db37e420e6421f631bfb1b252fe8ad199faff0a262cf
Instruction Fuzzy Hash: A001D1307442904FD3899B3D94504AE7BE6AFC626031A44FED08ACB3A6CE288C038751

Function 02CA887F Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

4']q, xrefs: 02CA8851

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 6fe7edbb141aa56cdab745f6deefbddb5598e175f046977f4b84c906a4f7d1ca
Instruction ID: 85b298d5f56bad79ff4fc348e665fb7452f08d8e92ff4003fc6e9b0bf846f70e
Opcode Fuzzy Hash: 6fe7edbb141aa56cdab745f6deefbddb5598e175f046977f4b84c906a4f7d1ca
Instruction Fuzzy Hash: DDF0F631B000059BC704EAB9E45179D3BA9FFC1608F5441A9D049DF364DF399D0587C1

Function 06F30718 Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eea9b3211402d4a3fbe60493092ccd1044bd824c25496140b77d7514fcf4ad1
Instruction ID: 16517fb67c1dddd7e7ef6c3dbaec1b4d6657825ae19cfc5903453720943218c7
Opcode Fuzzy Hash: 5eea9b3211402d4a3fbe60493092ccd1044bd824c25496140b77d7514fcf4ad1
Instruction Fuzzy Hash: DA12C874B502128FCB48DF79C59482977F6EF88A1871145A9E90ACB376EF35EC81CB90

Function 06F3DB30 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21616eeccd26bcb9e949253e9e0db987ff293eb414611bba1e96f7856501de3b
Instruction ID: ddf67ffc35ab3dee30184e47a29adb4f0ba0cefa45bdd4b8a24aaa33d6dc6e90
Opcode Fuzzy Hash: 21616eeccd26bcb9e949253e9e0db987ff293eb414611bba1e96f7856501de3b
Instruction Fuzzy Hash: 66025974A00215CFCB54DF68C5849AAFBF6FF89310B19C5A9E44A9B366D730ED44CBA0

Function 06F30040 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b60fad5db7934918460a1aab1bfcb6c2f47d0dcdc6d296af86f7fb218997d805
Instruction ID: fc0d8e56746d3e18989d1e402e0fe51f2929b954eb56fc22a1f261d9d2129406
Opcode Fuzzy Hash: b60fad5db7934918460a1aab1bfcb6c2f47d0dcdc6d296af86f7fb218997d805
Instruction Fuzzy Hash: 89F14975B106008FDB94DF6AC489B6ABBF6FF85214F1884AAE546CB371CB34E801CB51

Function 06F34508 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d018e5be45c8455da45b91d3dc7d1395a74d9bb0cc69b322c1e68eb6421daa95
Instruction ID: e239b317d522bafdbf8c1e838fec5a35e8cda26dc1b2e0a96539ce03b4377c67
Opcode Fuzzy Hash: d018e5be45c8455da45b91d3dc7d1395a74d9bb0cc69b322c1e68eb6421daa95
Instruction Fuzzy Hash: D0B1A931B046628FDBA0CF39C94466ABBE6FF89700B184929D947C7794DB74E841CBA1

Function 06F37320 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa52096a3368af0aa8d23efafe13490f3826fc49a5ca4c1d5c0c52131543d9a
Instruction ID: 73a3fd5546f5746f77b46022c403304c993e67a9cdc2911ddc61ad0a87aa3ac6
Opcode Fuzzy Hash: 5fa52096a3368af0aa8d23efafe13490f3826fc49a5ca4c1d5c0c52131543d9a
Instruction Fuzzy Hash: 9AB1B071B052508FD395EF28D598E6ABBE7EF86310B59C4AAD40ACB366CB30EC41C754

Function 06F52FF5 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 921960e454d8156f2e8b2f02e324520c320276f523ff8b64b3cd24f202149a85
Instruction ID: 0360e66466ad86f3b99d32bc0939f8fad4cbda1c07a39f8c117f9a705a2355d7
Opcode Fuzzy Hash: 921960e454d8156f2e8b2f02e324520c320276f523ff8b64b3cd24f202149a85
Instruction Fuzzy Hash: F491F332A01216AFCB119F78CC58ADFBFBBEF89210B18455AF54597355EB708905CBE0

Function 06F3BF68 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2100cfae7bed6fedfd4e1ddf7015f76fb4edea612cb59750cb50bd34979c1bc1
Instruction ID: 0e427227bd4a6ae3b0673e304a03f6901eb17e8a6a32f9169a698cd515376c7c
Opcode Fuzzy Hash: 2100cfae7bed6fedfd4e1ddf7015f76fb4edea612cb59750cb50bd34979c1bc1
Instruction Fuzzy Hash: 95B1C131A04350CFE7A1CF68C684B65BBE2FF41314F4994AAD485DF6A2D375E884CB90

Function 02CA65B6 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 762bae2ee737097b719d5d279ca29fa9cbc73dbebb8b733ce7ab703feaca2682
Instruction ID: bb051e4b459663d1defad7fab122ea46ac85f3a8dd2367c5b7a431e7c96f3bca
Opcode Fuzzy Hash: 762bae2ee737097b719d5d279ca29fa9cbc73dbebb8b733ce7ab703feaca2682
Instruction Fuzzy Hash: 25A16D70E1020ACFDF10CFA9C99579DBBF5AF88318F288129D819E7254EB749985CF81

Function 06F39848 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2181a5cff273d5050837e15ebbe3e4bb17360b6f7f82285b8edf6de67bb38857
Instruction ID: dc0c24ccf772e6ef76aace7bf2d11c167aa8cf0c30e39cb2ec18765c907e00cb
Opcode Fuzzy Hash: 2181a5cff273d5050837e15ebbe3e4bb17360b6f7f82285b8edf6de67bb38857
Instruction Fuzzy Hash: 6B819F31F0A235DFEFA50E64884473ABAA6AFC4B50F544529ED468B348EAF1CC81D7D1

Function 02CAA208 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4e361698e724a5c3ae7771b26326129b42c7728709df6b4a97ed9381c26ffb
Instruction ID: c772edf8c4c842aefcd0198d9aad988600dfc24d663108ca042b4ace8dbe7aba
Opcode Fuzzy Hash: 2a4e361698e724a5c3ae7771b26326129b42c7728709df6b4a97ed9381c26ffb
Instruction Fuzzy Hash: 85A18C70B002069FCB49EF75E4A4A6DB7B2FF89308B108969D8069B355DF389D46CB91

Function 02CA2A20 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd892168b0379238837a3973d9b4b48766649aae38073b2da1d98fc13205d1f5
Instruction ID: 68c985fff56060893b64c0f26791dc99c08da529f2aa04c3e9feb078740c1e23
Opcode Fuzzy Hash: cd892168b0379238837a3973d9b4b48766649aae38073b2da1d98fc13205d1f5
Instruction Fuzzy Hash: 40A17E746012419FDB09EF31E554A1E7BB2FF88315B108A69D5068B365DF389E8ACFC1

Function 073EBDB8 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303458791.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e560a0374fc66e2bf63d58786a2b4268ab26a08c3c1b8cf5318ae5b13172670f
Instruction ID: bcc15f91edf06900021d95a627fc77f14ca2c9eaa24a3042f0d0934abe0a4cce
Opcode Fuzzy Hash: e560a0374fc66e2bf63d58786a2b4268ab26a08c3c1b8cf5318ae5b13172670f
Instruction Fuzzy Hash: 17A149346002029FC719DF28D594D5ABBB6FF89311B108AA8E54A8F776DB30FC49CB91

Function 02CA2A30 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c9820cdff733f0bea9b38707c9da1886eed83121bea28bf8815eaa3a5fdec0
Instruction ID: 18adf1b44792bc1f483860212f730c619aa78a47592982f2d72ed1ede7ac7c9d
Opcode Fuzzy Hash: c8c9820cdff733f0bea9b38707c9da1886eed83121bea28bf8815eaa3a5fdec0
Instruction Fuzzy Hash: C9A16D746012419FDB09EF31E55491E7BB2FF88315B208A69D5068B365DF389E8ACFC1

Function 06F53046 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59e743ed9f941e945de2ebbc6a87ad0bae1910164b8312cad07f8f7f27bea53a
Instruction ID: 915c49f3f14a6ff2dac9ad9dd26e0bf7a1fa977582daaaf1bbddf6a148103d01
Opcode Fuzzy Hash: 59e743ed9f941e945de2ebbc6a87ad0bae1910164b8312cad07f8f7f27bea53a
Instruction Fuzzy Hash: B771DD32A01216AFCB119F78CC58ADEBFB7FFC9210B14856AE54597395EB349D01CBA0

Function 06F3DB29 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b720a46e559da784a473c587c83b3e84467e97eb595874abee2fa46e15a69884
Instruction ID: 7211e3bf06a28a05b649787d081a4c3ce5b65a02f73c528763e79e2253ba7764
Opcode Fuzzy Hash: b720a46e559da784a473c587c83b3e84467e97eb595874abee2fa46e15a69884
Instruction Fuzzy Hash: 50913574A00215CFCB51CF68C584AAEFBF6FF89310B198599E4499B326D734EC81CBA0

Function 06F33A00 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbfdc16b0b52f375e32786af90cec56922892a69c7a1a7bc84e8fc5d6b620069
Instruction ID: 1b6b3e844676aff7afb995b6f3d789ca074cec6cb336e6770ac8dc7cd8759078
Opcode Fuzzy Hash: dbfdc16b0b52f375e32786af90cec56922892a69c7a1a7bc84e8fc5d6b620069
Instruction Fuzzy Hash: 9181DC31A003958FC755DF28C494A6ABBF2FF89310B5985A9D446CF3A6CB34ED45CBA0

Function 06F38838 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7734a75673ed79207e024ca5309be24d29454ee0dbe824cf3219e90abac09aac
Instruction ID: 419d3fb2a40906c90f03096e5a37b959f9ce5bb6dc386885f2814315fffa488f
Opcode Fuzzy Hash: 7734a75673ed79207e024ca5309be24d29454ee0dbe824cf3219e90abac09aac
Instruction Fuzzy Hash: 3F81B131A00316CFCB94DF28D544A6AB7F6FF84350F108929E916C7398DB78E945CB91

Function 06F335B0 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae19c069eec05f7267da53c5dbfd42af24a65466d5e6d6c42c8a0ecf674567b3
Instruction ID: 082582dbeac1fed89c518bae139f0a546530d9acbc46923523d8ea609b25dd55
Opcode Fuzzy Hash: ae19c069eec05f7267da53c5dbfd42af24a65466d5e6d6c42c8a0ecf674567b3
Instruction Fuzzy Hash: 19618C75B002059FDB549F69D8586AEBBF6FFC9311F14802AE906DB3A4DB348C41CBA1

Function 073EDD90 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303458791.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38d693d67cd51556e90acaf57d2444cf71b1c0fd8fa5971fcbe3871e6fae89dc
Instruction ID: 93a7fa7a51953ff87c64a7a76f4bed8a3729cdd3c35f1dceb282a4a93a9f6069
Opcode Fuzzy Hash: 38d693d67cd51556e90acaf57d2444cf71b1c0fd8fa5971fcbe3871e6fae89dc
Instruction Fuzzy Hash: 55619C7160020A9FCB04DB58D980EAEFBBAFF84310B14CA69E4599B355D731FD46CBA0

Function 06F5A7C8 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a83cdd7bd2994d70c4def4a6e4a039261e7ab639e673f4cd8e4584e2e1791e00
Instruction ID: 9432334e84987cf89824b4c3e6d607b5587791167736585e08cc2ab535b83823
Opcode Fuzzy Hash: a83cdd7bd2994d70c4def4a6e4a039261e7ab639e673f4cd8e4584e2e1791e00
Instruction Fuzzy Hash: C451F771B442508FCB459B38E85496D7BEAEFC661571501AAE606CF3B2DE34CC06C791

Function 06F335A1 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76ab0e50aa9b60dcfe60f875f215648a3ca95dfc38e08b99e6203c105d80bd31
Instruction ID: 342ff6690df23f0e5274cde8cd5a48b7cb88aae4c0ed37d4440e4702c8f546ca
Opcode Fuzzy Hash: 76ab0e50aa9b60dcfe60f875f215648a3ca95dfc38e08b99e6203c105d80bd31
Instruction Fuzzy Hash: 50518B75B002159FDB549F69D858AAEBAF6FFC8311F148029E906D73A4DF348C41CBA1

Function 06F38648 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab37415a0b950fc0469a05c6cd5b1bedbde2b569e15598706f06aca23b42d282
Instruction ID: da50c562272bc7403be8b82246a40f19261e76fa720fd7ce9f184a8057d2c132
Opcode Fuzzy Hash: ab37415a0b950fc0469a05c6cd5b1bedbde2b569e15598706f06aca23b42d282
Instruction Fuzzy Hash: F061C7B5E102598FDB54CFA9C880A9EBBF6FF88350F14406AE919EB314E7359D41CB90

Function 06F34058 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69b91debca93ba99c8b36605bb89ff0a96593eca6da75d567d5ac3a4653b7ecc
Instruction ID: dbd32975ffbfe0329a4ed761b7f9ceb4b7c8e61d4b46c4094cfbe30d8b46e79e
Opcode Fuzzy Hash: 69b91debca93ba99c8b36605bb89ff0a96593eca6da75d567d5ac3a4653b7ecc
Instruction Fuzzy Hash: E8717970A003059FCB49DF68D484A99BBF2FF89300B10C569D4599F366D770EC8ACB90

Function 02CAB922 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0b4f77700e47c48799f4a4dc2923c0119e3005ef68ae700f51081ef2fe8ba3
Instruction ID: 613644965ef771883c9fd09abb99b1c38a95c8c895b5f27db2c1afb094c9f285
Opcode Fuzzy Hash: 8f0b4f77700e47c48799f4a4dc2923c0119e3005ef68ae700f51081ef2fe8ba3
Instruction Fuzzy Hash: A651A6B07012019FD748DB65D998A6AFBEBEFC8300B08C968D5098F3A5DE799C45DB90

Function 06F38828 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3451431894071c41bee3974b428fad1ecc9a4ff1e5def3d5f49f6ef7fa55fcf2
Instruction ID: 997fbd90cdbbf684fd1bb9378cc7b0888fd14d31e7f917aac83debe650abb5cf
Opcode Fuzzy Hash: 3451431894071c41bee3974b428fad1ecc9a4ff1e5def3d5f49f6ef7fa55fcf2
Instruction Fuzzy Hash: 9751C431A00316CFCBA4CF28D544AAABBF6FF84350F148529E456C73A5DB78E945CB91

Function 02CAB930 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18f62ff74de1b00d52109b65862ac5af5db33bc3ea3f605717dfa2385f3b389b
Instruction ID: 0108b6b2e8d9e5c0826bcaf08b449fc601b6bfebf79123063616580b2a3fd608
Opcode Fuzzy Hash: 18f62ff74de1b00d52109b65862ac5af5db33bc3ea3f605717dfa2385f3b389b
Instruction Fuzzy Hash: C651B5B06012059FD748DB65D998A6AFBEBEFC8300708C968D5098F3A5DF799C45CB90

Function 02CA9429 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac163916e5934ff8f048422a29a6e959b6495c5eade82105c212b508e4c81b0
Instruction ID: fd5a95ffe80eb20ed0766bc20796f6f1e923aca7d11afc0b6ecb6a052070a2df
Opcode Fuzzy Hash: 7ac163916e5934ff8f048422a29a6e959b6495c5eade82105c212b508e4c81b0
Instruction Fuzzy Hash: 2451AF74A00116CFC704DF68C995AAABBB2FF89315F1681A9E406AF7A6C735EC01CB50

Function 06F38638 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28ecea3ab826a14b4bf207bd26ed6a4bb94b0ed73664b317142fdc742e47bedc
Instruction ID: ec2bde1d6194bbfca9f6453ea6cff102a12a8a9752730f045363cdaa6e665a5a
Opcode Fuzzy Hash: 28ecea3ab826a14b4bf207bd26ed6a4bb94b0ed73664b317142fdc742e47bedc
Instruction Fuzzy Hash: 2C51F6B5E102598FDB54CFA9C89099EBBF6BF88340F14406AE919EB314E734DD01CBA0

Function 06F3330B Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 146fd28a5b1b83dd2ae82822afdd4abe6fe61c245717ae2282c26613a61f1600
Instruction ID: cebe12f4a72f172478e47a3c1d722ec64ab99cdab563958f710a3f9c4eeeb4cf
Opcode Fuzzy Hash: 146fd28a5b1b83dd2ae82822afdd4abe6fe61c245717ae2282c26613a61f1600
Instruction Fuzzy Hash: 92516B75A01255DFCB55CF64D488A99BBF2BF89310F1581A9E805AB366CB31EC81CB60

Function 06F33318 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beabc892a3e0b9772e32293efd202e63357fbbb043830b35ebc86079702d4754
Instruction ID: 3377cce3c4a3f2f7753e3a7a5ffdd8b82e704d70eebd62321083ef5751dc4bfb
Opcode Fuzzy Hash: beabc892a3e0b9772e32293efd202e63357fbbb043830b35ebc86079702d4754
Instruction Fuzzy Hash: 5B515975A00255DFCB55CF68D488A9DBBF2BF89310F1581A9E805AB366DB31EC81CB60

Function 06F3B3CB Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a1351efee89068ffe224f26350f404fbf6829fff7fd24156df8e0237deb3e6
Instruction ID: dcb9e29631d8b7587d9a56c454a3ed584754f6980876d1cbf203ce6652fc4924
Opcode Fuzzy Hash: e8a1351efee89068ffe224f26350f404fbf6829fff7fd24156df8e0237deb3e6
Instruction Fuzzy Hash: 17510374E007198FDB55CF99C894A9EFBF2BF48310F14856AE84AAB765D730E885CB40

Function 06F37098 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d7ab7ad07ca03199fcfeef33d321fba5476e467f675af85334ae80f6504c333
Instruction ID: 0de9d661a6b8cbd46b705faa53e38004c61ec7bb33dd160046f52950cde2e3a9
Opcode Fuzzy Hash: 9d7ab7ad07ca03199fcfeef33d321fba5476e467f675af85334ae80f6504c333
Instruction Fuzzy Hash: E24117B2B046269FE7B07A768E10627B7EBAFC4310F044859F647C7384DB24D881CB99

Function 06F57310 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eb3d5bf330cdef7293051be8493485176163b68025d10b3d519c222b538ca24
Instruction ID: 1c381c58399556bc14dde9e392dbc7fc4e52f2397da83bd3610e8547273c9bea
Opcode Fuzzy Hash: 8eb3d5bf330cdef7293051be8493485176163b68025d10b3d519c222b538ca24
Instruction Fuzzy Hash: 46519A31E04259CFCB51DF69C884AAEBBF2FF45220F168599E955DB2A1D730ED40CBA0

Function 06F56D18 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dee1d56e2722c09519dca53979c5935ba4c085a4ed51517e8720ddce2a8da2bd
Instruction ID: 523f8cbec02ecfe4081680c2d95a42e09fa41cdd8d168dcc8195f69da67e086e
Opcode Fuzzy Hash: dee1d56e2722c09519dca53979c5935ba4c085a4ed51517e8720ddce2a8da2bd
Instruction Fuzzy Hash: 9241A936A00209AFCB42DFA5DC408EF7FBAEF852117158466FA15D7221D731DD25CBA1

Function 06F3A838 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0636c67ecbd4f5664520b0f4f8224d75b703d0673ecfb30ec8d5417419478c39
Instruction ID: d696b9778fbb65268771e68d9f3059fe4420b74e8cfa10bda869bd94294b6b5f
Opcode Fuzzy Hash: 0636c67ecbd4f5664520b0f4f8224d75b703d0673ecfb30ec8d5417419478c39
Instruction Fuzzy Hash: C6515E36A00109AFDB50DFA9D844AEEFBF6FF88320F14816AE605DB311D731A955CB90

Function 06F30FE8 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a0d966020f5e03d98392228cd521ce6b43268365d177f95b08b774d6a4a40c2
Instruction ID: d394e42ce8738066fa122dfff0e2558a980cb1a96834c875f9016f4c1dbf59c3
Opcode Fuzzy Hash: 1a0d966020f5e03d98392228cd521ce6b43268365d177f95b08b774d6a4a40c2
Instruction Fuzzy Hash: 7E412476F006668FCB51DB7AD98086ABBFAEFC521071584A6E549CB351DA30EC02C7A1

Function 06F56E69 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9be2e97b690e1d1b166e4ff8dcae08d8eb6542db0de763c28932ece92d55f4e
Instruction ID: 46e9e2d60c06d516c2b8a6ee3fb297a169679c75854d4907a360cd93f67f7b08
Opcode Fuzzy Hash: d9be2e97b690e1d1b166e4ff8dcae08d8eb6542db0de763c28932ece92d55f4e
Instruction Fuzzy Hash: F6416035A00105EFCB519F58C8958AABBB6EF49321B05C495FE15CF326D731ED51CB90

Function 02CA37F8 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f13f17c7dc3ba10e378c788f9fbdd89b3e17e6c0187d1d32f85d09a42debd330
Instruction ID: 4be7df0069a75d149e353c5f626f23a18b782add0122e08c6a42ba6c88cd2169
Opcode Fuzzy Hash: f13f17c7dc3ba10e378c788f9fbdd89b3e17e6c0187d1d32f85d09a42debd330
Instruction Fuzzy Hash: 1041CE71B042448FCB24EB79D4A47AEBBE6EFC8214F14886DD50A9B340CF349C06CB91

Function 02CA0AA0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acde95589af1be32a6db77f0d8f5d27239abc26b6c635c31f07b1e4d2b70df2d
Instruction ID: edfde85bfa1186077dbddef79a71ef2b7894c2757cadde02ba0c098d6acc6a60
Opcode Fuzzy Hash: acde95589af1be32a6db77f0d8f5d27239abc26b6c635c31f07b1e4d2b70df2d
Instruction Fuzzy Hash: 2B51E434500209CFD799DF25F58499A777AFF8D3053508668D826CB269EF39AD86CF80

Function 073EF5B8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303458791.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 654f727383c95760384fb368daa31a41edc1b7f819c9074c8d0449177f6818ae
Instruction ID: d9eb0b9ac125bbd483b639b7b4ac6e9087ac141e4b3e94eb25d5113b0d96a0a9
Opcode Fuzzy Hash: 654f727383c95760384fb368daa31a41edc1b7f819c9074c8d0449177f6818ae
Instruction Fuzzy Hash: 55412E312002019FC719AB75E594A6EB7ABFFC8201B148A28D5478F758EF75ED0ACB91

Function 02CA11D0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ae8b0ce142b021ca62f011be26f3ad5f9a5af993f654344dfbc7fd4fb7a7d53
Instruction ID: 7fb2c6474fc421ec04b3390139f273276e362d60afa6ec14bdbdacd02b102439
Opcode Fuzzy Hash: 8ae8b0ce142b021ca62f011be26f3ad5f9a5af993f654344dfbc7fd4fb7a7d53
Instruction Fuzzy Hash: 70419F70E0020AAFCB44DFB9C5946AEFBFAFF88310F248569D449D7355DA349D428B91

Function 073EE5C8 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303458791.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfbb3c8bdaec8f0580b56c773da63fd835882ffbca7936903e8bb5c19217b2b6
Instruction ID: d77c5711db91f56ff7c00fbc4057b294a85432ed5a189a1e415170590aac0618
Opcode Fuzzy Hash: bfbb3c8bdaec8f0580b56c773da63fd835882ffbca7936903e8bb5c19217b2b6
Instruction Fuzzy Hash: 034160312007019FC359EB25E994B9AB7EAEFC1310F409A2CD1878F669DB74F908CB91

Function 06F37E80 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d29e8a633bbda82d352a326f99aee039a8ce6b7653fe62b3af9b6092680c0e
Instruction ID: bd3bce3a2e51e1c8dea2d3ff12f535cd5869e3da55666769b8c0fb62888b6155
Opcode Fuzzy Hash: 76d29e8a633bbda82d352a326f99aee039a8ce6b7653fe62b3af9b6092680c0e
Instruction Fuzzy Hash: 02414FB4A002168FCB54EF69C594AAAFBF6FF88300B14C569D8169B365DB30ED45CBD0

Function 06F59D48 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a12c54bbdc52d81d528cdc9933e452af5a522124d60f61c78387463dd88bb1ea
Instruction ID: 7b726d866cc8d4dbb64c31f348468c84127a4bf7d4aa15c9f9174d77b11787bf
Opcode Fuzzy Hash: a12c54bbdc52d81d528cdc9933e452af5a522124d60f61c78387463dd88bb1ea
Instruction Fuzzy Hash: 6931AF35B002168FCB48EF79D8A45AEBBB7FF88210B114569D94ACB391DB349D01CB90

Function 06F30716 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62e28dc15bd3cb94e4405fa348b0451fd97cbb82531c98791f9f6bec9f546eb
Instruction ID: 11bc98172b09144cff0c0f5a392d7ba13489b698cf84a9a7f92525d862fcaca2
Opcode Fuzzy Hash: a62e28dc15bd3cb94e4405fa348b0451fd97cbb82531c98791f9f6bec9f546eb
Instruction Fuzzy Hash: 2C412774E00616DFC794DF69C9849AAFBF6FF88300B10856AE50A97765CB30EC41CBA0

Function 06F50BC7 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6984e9e6e38fa095575479abae32a07210426e15a4da3f2ba490e418762564f4
Instruction ID: 55ce7932cb5507b6e835b736661cd461493849fcf18e20a1dfc6f5752e5e6de1
Opcode Fuzzy Hash: 6984e9e6e38fa095575479abae32a07210426e15a4da3f2ba490e418762564f4
Instruction Fuzzy Hash: 4131AE3150A3D59FC702DF3CD8A49DABFB5EF8A224B1940EBD4848F263D6359809CB95

Function 02CA4206 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c6007c2cd966d4e3320679b71d9d7f4b9e10df33b8f3fdce0a6b49c93d225f7
Instruction ID: 485ae75de820b11c0756c6cebc3b6d76289a9ea05614c372ad561659c77652ee
Opcode Fuzzy Hash: 3c6007c2cd966d4e3320679b71d9d7f4b9e10df33b8f3fdce0a6b49c93d225f7
Instruction Fuzzy Hash: 03411EB0D00349DFCB14DFA9C590ADEBFB5BF48314F14842AE819AB254DB75A945CB90

Function 02CA4210 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 467ded4a27cdc3901103784911f06308e5168a481fa7ef8faacaa6ea7c102679
Instruction ID: 89c55013510d09cf0f6fecd57b2218432b2f09c8645d7407420208007b40feeb
Opcode Fuzzy Hash: 467ded4a27cdc3901103784911f06308e5168a481fa7ef8faacaa6ea7c102679
Instruction Fuzzy Hash: 8841EEB0D00349DFDB24DFA9C594ADEBFB5FF48314F208029E819AB254DBB5A945CB90

Function 06F321C8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23d8b7ccbfcb8b1434605b633deab2bebf93adbad69b74a94438af6b1b5b743a
Instruction ID: 4f33188173aba6cd6c33b45dea9ace61fc9ecc4e5841d839686847325e65696f
Opcode Fuzzy Hash: 23d8b7ccbfcb8b1434605b633deab2bebf93adbad69b74a94438af6b1b5b743a
Instruction Fuzzy Hash: A931FD30E11625CFDBA4CF68CE80AAABBB4FF45300F0584A9E945DB265C730ED41CBA1

Function 06F31130 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3397b8af8f39cdb4837444afdfe971fdf58b831c1c2239d2480d603ea41ea4ac
Instruction ID: b5a19e7fefa483fe73f2ac2828b3344f75ebd6888bb1eade2928195d11570928
Opcode Fuzzy Hash: 3397b8af8f39cdb4837444afdfe971fdf58b831c1c2239d2480d603ea41ea4ac
Instruction Fuzzy Hash: 51216A35B001208FC758EF3ED988E6A7BEBAF8965471541AAE606CB375DE30DC41CB91

Function 06F59D38 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d7d5a2e96ff68b590519bcc9647a476d03b04f0c40218770677a24930ab43e6
Instruction ID: c9d91375479b8272c70052eb2b08bc686030ca481298ac7d44e4fce7895f1233
Opcode Fuzzy Hash: 8d7d5a2e96ff68b590519bcc9647a476d03b04f0c40218770677a24930ab43e6
Instruction Fuzzy Hash: C621D635B0025ACFCB58DF75D8949AEBBB6FF883107014169D99ACB3A1DB349C01CB90

Function 06F37E70 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c607fa8df43bccae01c83aaacadff2f1d99af594d3355487dde2cf9e6c870f24
Instruction ID: 8a1459d9bbac250ab2af0287b96c21e7fcbe18bc689c384c31d01856c0952502
Opcode Fuzzy Hash: c607fa8df43bccae01c83aaacadff2f1d99af594d3355487dde2cf9e6c870f24
Instruction Fuzzy Hash: CA3180B0A002169FDB54EF69C994AAAFBF6FF85300F048569E8168B365D730DC44CBE0

Function 06F3AF38 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8799ff0e56352a34b4bc13aab7195b0a68499cd1909743ec511cac9a889b7b2
Instruction ID: a00bc1f6fbe089ab3372bdae1a87325de6d7c2510ec98d2edb39254aaaf2e2ca
Opcode Fuzzy Hash: b8799ff0e56352a34b4bc13aab7195b0a68499cd1909743ec511cac9a889b7b2
Instruction Fuzzy Hash: 9621717570011A9FDB049F75E864ABE7BA7FB88361F044429F952DB380DB35AC10CBA1

Function 073EEB78 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303458791.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80187f600a70c24ed1d36b5cf45d72ab075cdb77a5fa649976a79bc04b3e68ae
Instruction ID: 9ff57b3549d3913d00eef4602c237e4981db51885e02277f3ba34825b0d2364d
Opcode Fuzzy Hash: 80187f600a70c24ed1d36b5cf45d72ab075cdb77a5fa649976a79bc04b3e68ae
Instruction Fuzzy Hash: 862141303403019BD718AE76ACA0BBF669BEFC0251F499928E5438F39CDD75ED0A9394

Function 02CA0998 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e15123f3209139fafe3828267ab0165fbc74709d810f6df1f6b6f0292f7dc493
Instruction ID: 26c529ee8b66958b159173597d21dfd439145086e07549a174f2de1385855c38
Opcode Fuzzy Hash: e15123f3209139fafe3828267ab0165fbc74709d810f6df1f6b6f0292f7dc493
Instruction Fuzzy Hash: FA214130B802079FEBA89B75D9687BE3BA4EF85389B04543DD807C6151EB348E41CB52

Function 0103D3B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3295651312.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_103d000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e3048708a670844be508fed0a5dbd0ab6c4e691524143f260f8a394a1ac9225
Instruction ID: 369bd47c71fa44e74425a5a659befbb5d3e05a354446ca6ab301c3d373b0fa6d
Opcode Fuzzy Hash: 9e3048708a670844be508fed0a5dbd0ab6c4e691524143f260f8a394a1ac9225
Instruction Fuzzy Hash: F5212571500200DFDB05DF98D9C0F6ABFA9FBC8314F60C5A9E9490B256C73AE456C7A2

Function 06F3CE90 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdb185f9de28796f9cd83c01996b425d73583e3a106448147d3a7bc23181ea16
Instruction ID: ec77b4bb70c6aec53c8e6233e52fc5935330934b6251b974fee217b098e31def
Opcode Fuzzy Hash: fdb185f9de28796f9cd83c01996b425d73583e3a106448147d3a7bc23181ea16
Instruction Fuzzy Hash: CE219D31B017159FC725CF29C94495ABBF6EF88310B05C4AAE55ADB262DB30EC04CB90

Function 06F34281 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae8ea019ddd383da9b3a64559fb16022fa70a342d9b7773aa9f9aad290d52f05
Instruction ID: d3e39ac92298c9e0bd59bd1bcd0e3aebaf71a459d48e600bf6e68ee471295f42
Opcode Fuzzy Hash: ae8ea019ddd383da9b3a64559fb16022fa70a342d9b7773aa9f9aad290d52f05
Instruction Fuzzy Hash: 35219C317013909FD3558F24D484E5A7FB6EF86314B1584AEE5868F3A6CB30DD49CB50

Function 02CA8FF2 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3679e3b69f6c9b9b8ba807fd2a60170ea28bd4bca6f46f60dbc8f8761cf2705
Instruction ID: a645d23d9dfa101c12867532f0985d4785541b3ffa26f4d26ef2e784c9e74ee8
Opcode Fuzzy Hash: f3679e3b69f6c9b9b8ba807fd2a60170ea28bd4bca6f46f60dbc8f8761cf2705
Instruction Fuzzy Hash: D821AC30600206DFDB19EB75D565AAE7BF6FF89309F144868C402AB364DF359C82CB91

Function 06F3AF33 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 037d8db1b13102de48b4ed77d7a2f22b55abbb927ddfb6ae79094ebd052fbbf4
Instruction ID: ef35be60bc9defc4bb4d4c27b7ed5bcd369c97658dc7da6187ade31f5a8e9307
Opcode Fuzzy Hash: 037d8db1b13102de48b4ed77d7a2f22b55abbb927ddfb6ae79094ebd052fbbf4
Instruction Fuzzy Hash: 8721817570021A9FDB149F75E8A4ABEBBB6FF88261B04441DF952DB340DB35AC10CBA1

Function 06F38AA8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49cc9b57b881ca15e191d7d1b176e7352dff78cf92cc049f9c00a72a3c5f8b1e
Instruction ID: 178502df87472775542e8548932b3f2d3710aeaa8f4e412d6176036155c3ecb4
Opcode Fuzzy Hash: 49cc9b57b881ca15e191d7d1b176e7352dff78cf92cc049f9c00a72a3c5f8b1e
Instruction Fuzzy Hash: AD11C473B0826A5FE754DA69E8406AAF7E5EBC43B1B188137F514CB280D7399811C7D4

Function 02CA09A8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba41d376c8848a12b9422b57823b0bcea1560eeb290f84065f4cb0723a7ff58d
Instruction ID: 405d2cbaa68b37df949c5e62790c6cb9f5a329fbbc22759a7ded66e33d16cea2
Opcode Fuzzy Hash: ba41d376c8848a12b9422b57823b0bcea1560eeb290f84065f4cb0723a7ff58d
Instruction Fuzzy Hash: 2E2154307502079FDBA86BB6E56876E7BA4AF8538DB04443DD807C6150EF348E41CB52

Function 06F34B40 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f9b0d609aa7265030903c82d85acad3d0cd259ede874e89ef68b7fba1829730
Instruction ID: b3ed457c9c2ea938eb2991556f385b99dd60519c612a4eb2b4b06164465de1f7
Opcode Fuzzy Hash: 6f9b0d609aa7265030903c82d85acad3d0cd259ede874e89ef68b7fba1829730
Instruction Fuzzy Hash: 27119132B002258BD7581E3AB85426DB7EBEFC1676314407EE20ACB784CF39D852C760

Function 06F343B1 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e3d9849be4841b07a36efa5449ae4fd1b4782d53a23c1bb373d12df4efd4b06
Instruction ID: bf61a69b6fa68fcf0c909ae5a83b4124ffd254c8b5c0f385fc2a258c75d5365e
Opcode Fuzzy Hash: 6e3d9849be4841b07a36efa5449ae4fd1b4782d53a23c1bb373d12df4efd4b06
Instruction Fuzzy Hash: 8C11B1327053546FC715DFA4E840AAABBBAFF85210F18856AE144CB392D7719909C7B1

Function 06F36FF3 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a0328224d415cbcd28f07b91ec0b778410e160b49905343c4462691d4c2192b
Instruction ID: 04ebd5005fb94099cd2ae8551ce66168baecfee678454bdb5900367ccce1cf94
Opcode Fuzzy Hash: 8a0328224d415cbcd28f07b91ec0b778410e160b49905343c4462691d4c2192b
Instruction Fuzzy Hash: 002163312017059FC765DF3DE940C9B7BEAEF85350B00862AE446CB229EB30ED09CBA1

Function 06F34290 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30fb8aa858f2ece19f59b09f612df6790542440c6c37373ca0c7a1e3a8f79399
Instruction ID: 1b90db340f422625877695f3358667b321d77548e0112b38e8b6800202f59a63
Opcode Fuzzy Hash: 30fb8aa858f2ece19f59b09f612df6790542440c6c37373ca0c7a1e3a8f79399
Instruction Fuzzy Hash: F521BB317003409FD3149F24D488E5ABBF6EF86310B1584AAE5868F3A6CB30ED44CB50

Function 06F369F8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d97e5c6afe2b10ae2a1c5dfe27bc6a0b7bdfb4b069f5636ab49c79976130bd51
Instruction ID: bba12397ec79e8d6aaaa4facbf99ce0c4bc29cf10a64b1164b08a60c3ea42b0c
Opcode Fuzzy Hash: d97e5c6afe2b10ae2a1c5dfe27bc6a0b7bdfb4b069f5636ab49c79976130bd51
Instruction Fuzzy Hash: 46219F35E04258AFDF11CFA4C850A9EBFB6FF49310F00809AEA51AB359D731D815CB91

Function 06F57DC8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33cb15a0173dfad1c752c102c9ee037f0f034ff71eea605e29e4c5622aaaa7ac
Instruction ID: 337907892052fd7d898d2cc8dd55eb3ec3b9185730beb92abd4fcfc6eee271d5
Opcode Fuzzy Hash: 33cb15a0173dfad1c752c102c9ee037f0f034ff71eea605e29e4c5622aaaa7ac
Instruction Fuzzy Hash: 1921AF71E0025ADFCF04DF64C58496ABBF2FF89310B1181A8D909AB725D730ED01CB91

Function 06F34C90 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9da52365d1bf3c973ca670e55878d8dc7ae80e3a3368360767ff8a43428a1e26
Instruction ID: 1b7fab4d4902ea7da4b5cfc4272445a0d6646b3e8481d8e9ee3a7adf5e402631
Opcode Fuzzy Hash: 9da52365d1bf3c973ca670e55878d8dc7ae80e3a3368360767ff8a43428a1e26
Instruction Fuzzy Hash: F811E631B003109FD3758F26E880A13BBE7EF85324B14846ED54A87716C732EC85C750

Function 06F57DB9 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e86ff4c8ac3fef1f101670e5461d5fdc78bdad5878140ea746b4d5688a624c3e
Instruction ID: 10ca7c060aec6da29d9eb86b4fc594cc22b2ce96b2392e6bd9ebc726d5822c54
Opcode Fuzzy Hash: e86ff4c8ac3fef1f101670e5461d5fdc78bdad5878140ea746b4d5688a624c3e
Instruction Fuzzy Hash: 2421BE70E01296CFCB15CF28C5849AABFF2FF89300B1186A9D9489B725D730ED05CB91

Function 06F583A0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae09c5beda35414eaf4996d80b7d3186ca3e9aa5ef3d11848955c689b06b30c
Instruction ID: 0db5b87d7c3aad88ddfbb27e6990991b7fe96598900d228f420d00075112c0a6
Opcode Fuzzy Hash: dae09c5beda35414eaf4996d80b7d3186ca3e9aa5ef3d11848955c689b06b30c
Instruction Fuzzy Hash: A6112930B0875A8FCB955B3898241397FE9AF8928075744AADD86CB392DE34CC05C796

Function 06F30510 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ef033129078d3e37ee26f46ccd9110c63a6e3bdfd655d221ce0a42db7f947f
Instruction ID: d41f2b3af92e25177d46bc81b7172b7681a84f0d36d3b603c05fa963dd1de138
Opcode Fuzzy Hash: a5ef033129078d3e37ee26f46ccd9110c63a6e3bdfd655d221ce0a42db7f947f
Instruction Fuzzy Hash: ED118272B406208FD3A59A6D9C50B6BB7DADFC8660F10412AEA06DB394DE71DC018790

Function 06F58F00 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe9720dd2e92e9af9b5e025473174a359c531f61f15eb0f65c5d5dd36b328f3f
Instruction ID: 56536cfc000802e6e18db51d3cdc5bd381b6c341a77f0a71865dcdeca9e3b3bd
Opcode Fuzzy Hash: fe9720dd2e92e9af9b5e025473174a359c531f61f15eb0f65c5d5dd36b328f3f
Instruction Fuzzy Hash: FC11E031B001264FC3949769995096BB6CFEFC8750B42462DDA558F358DE70DC05C7C1

Function 06F34D48 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e72f23c3552ca270035297b21fb1c7aba7ccc2d165f5a14d30fb91598a178ebc
Instruction ID: 6fbcfa09f35e72f576b286f4e73a008014832c1e411af5645c4342565d034b46
Opcode Fuzzy Hash: e72f23c3552ca270035297b21fb1c7aba7ccc2d165f5a14d30fb91598a178ebc
Instruction Fuzzy Hash: 4B011232F041219BE7A4557F985477AA6DFAFC5750F14403EA607C7788DE65CC81C2A1

Function 06F58EF1 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46065458af10e0057b00a309f5f7bcf0c3ed3a7882464ce45dbe1566d5669e66
Instruction ID: 10a2f0dae021b0effdf5fbad749723099045a791cbbf14fb67eaeca3ef0482b7
Opcode Fuzzy Hash: 46065458af10e0057b00a309f5f7bcf0c3ed3a7882464ce45dbe1566d5669e66
Instruction Fuzzy Hash: 06110A317052154FC3549B299C9096AFBDBAFC8350B06476EEA998F354DB30DC05C7D1

Function 06F5A9A0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c479a25cd54487521999c4a10f08aeefa7b507d4d4cb042de8627429c3995c8b
Instruction ID: 3dab7066172429aa53a2700d3ea8766bb39c2d2205b0fca2cb79324af413615d
Opcode Fuzzy Hash: c479a25cd54487521999c4a10f08aeefa7b507d4d4cb042de8627429c3995c8b
Instruction Fuzzy Hash: 5E11E770A012069FCB44EF78E45099EBBF5EF85318B10876DC1459B246DB758E0ACFD1

Function 02CAA1F9 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c147178ebbdadcaf1dbb7dd34dd4ed3d61232988913ebc9c892ae00948b65013
Instruction ID: 187df6a0ee39f642092e486c395ae0d1d43b20ee681226c979d88d624eb0ecca
Opcode Fuzzy Hash: c147178ebbdadcaf1dbb7dd34dd4ed3d61232988913ebc9c892ae00948b65013
Instruction Fuzzy Hash: 8D115C357002015BCB189B79D5A066D77EBEFC46187108A79CD05DB39AEF34DD0687D2

Function 02CAFD70 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b6dc83ba790e1d92a2bbaaac194616ca5d2847a26643bbff5a2849a2d0d9ec
Instruction ID: 7bdf245fbcd86631af256744da8f49c5c3a593590b565b855a5929abcdf7e1ee
Opcode Fuzzy Hash: e6b6dc83ba790e1d92a2bbaaac194616ca5d2847a26643bbff5a2849a2d0d9ec
Instruction Fuzzy Hash: EE119370A0060ADFCF21DF99D8C489AFBF6FF84314750856AD509D7655DB31AD10CBA0

Function 06F59AF8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a686bcc79f6d8a18838c3882d0198a9f18aa4d442a9b9cea51b277a4c0e8a49
Instruction ID: 42941fff85a2e701c7de06a8e467c5ab87188f697f194562e3fe1ddffbd3ea64
Opcode Fuzzy Hash: 5a686bcc79f6d8a18838c3882d0198a9f18aa4d442a9b9cea51b277a4c0e8a49
Instruction Fuzzy Hash: 4B11007650808BEFEB9C7BE4947C468BB76ABC53317434154EB438B240CB754E00CA95

Function 06F524D0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86ca3f3b1b86ed7e66386df88a95d666b5b54ceded459201ce110b841e71fa1
Instruction ID: 3df9d0c0c7fb65fbd1d9a12641ba6a31bfa618b8e19407ff7796e088cdc48aab
Opcode Fuzzy Hash: c86ca3f3b1b86ed7e66386df88a95d666b5b54ceded459201ce110b841e71fa1
Instruction Fuzzy Hash: 1F116D30F042558FCB449BB8D8644AE7BF6EF89300B1144BAD606DB3A5DB349D05CB91

Function 06F3ED48 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8ed524af7ee7f814b5d47954d0cb53801c4159190f040dd3d80e614cb9ad513
Instruction ID: 83fc4dd7493374b7126edad73558cc380162a040c702fdc827c125577b7fd2f5
Opcode Fuzzy Hash: b8ed524af7ee7f814b5d47954d0cb53801c4159190f040dd3d80e614cb9ad513
Instruction Fuzzy Hash: EA11E031B04219DFCB51DFA8D8444AEBFBBFFC9200B14442AE646D7204DA308905CBA1

Function 06F343C0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2725ea519ce9e5bfe54e52aa3e53b1f199315b01a32387a1b8293100daf927
Instruction ID: 514f764691848067fcaa7a2397ca0580326445a798dbd84e5936886ff5d583cf
Opcode Fuzzy Hash: 4f2725ea519ce9e5bfe54e52aa3e53b1f199315b01a32387a1b8293100daf927
Instruction Fuzzy Hash: DA11C8327042146FD714DF94E884EAB77EEFB88320F10852AF605DB350EB71D80587A1

Function 073EEC90 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303458791.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc84126d720a9fb4bbdce61cfaff0793b53165e2b8a8377d338825e98d2cc9c2
Instruction ID: 0ffa71881bddb73e08ba5cf06fc86afb4a188a02f9e82df585737664ccc4144f
Opcode Fuzzy Hash: bc84126d720a9fb4bbdce61cfaff0793b53165e2b8a8377d338825e98d2cc9c2
Instruction Fuzzy Hash: D211C1723003168FDB249F68E488A2FB7BAFFC4220700462DE90A8B354DB74EC01CB90

Function 02CA1431 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 973c6e9cec41962d1b79b03a6ee2f0be57a6d4878b18464a9bd432bf332c84f7
Instruction ID: 59c6b7d5cb7c007c20ea0ef30cd0c4e368830099614a305d89955a5a62ad4ac4
Opcode Fuzzy Hash: 973c6e9cec41962d1b79b03a6ee2f0be57a6d4878b18464a9bd432bf332c84f7
Instruction Fuzzy Hash: 1A115A70A00206DFDB98DBB9D40466A77F6FF89319B1504BDD50ACB355EB389D52CB80

Function 073EA7F8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303458791.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3588e6921c12058359cc8d5d056f09a929fd2c8630e351b2fce58151c09331ac
Instruction ID: ef2c169bf51c13bc8c8ab0383e3a716d7427b0b2e0654496530e39f4c14f8faf
Opcode Fuzzy Hash: 3588e6921c12058359cc8d5d056f09a929fd2c8630e351b2fce58151c09331ac
Instruction Fuzzy Hash: D6118A713002055BD7159E65E494A6EBBDEFFC4211F508539E50A8F794EE70EC0A8792

Function 0103D3AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3295651312.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_103d000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 8e0c6d209c69c1cb601244655d0699b80d155e2360aee5d7eac18a6866d19fd0
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 5D11E172404280CFCB02CF54D5C4B56BFB2FB84314F24C5A9D9490B657C336E45ACBA2

Function 06F30501 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8703c335177166168e5933f956af1d40b073e7e07b13a730185e1021cc751e73
Instruction ID: 604ba8754b83526ea356dff277e7214920e101c98bb457baed3d0bc31e80adce
Opcode Fuzzy Hash: 8703c335177166168e5933f956af1d40b073e7e07b13a730185e1021cc751e73
Instruction Fuzzy Hash: 0D01B571B013249FC3658B2DC850A9AB7FAEFC9660B15416AE949CB354DE30DC01C7A0

Function 06F60AD2 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303059087.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f60000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee854789b2472363f8f1c22e80b7b68583fae8dd50e11560ac1f1f4a807616df
Instruction ID: b488c2e12a955f2b93bf644708c37c989f12dd156409d36d807dd8ac19b2c7c2
Opcode Fuzzy Hash: ee854789b2472363f8f1c22e80b7b68583fae8dd50e11560ac1f1f4a807616df
Instruction Fuzzy Hash: DD114F70D14208EFDB84DF6ADA9569DBBF1EB85204F20C4AAD406E7290EF749A80CB45

Function 02CA1440 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07eba3370d4ed5524ad699d1058730ea3ff6ec5bc7e028c01b4af5dc36804711
Instruction ID: 6cb6c65de6dcd0ebfa5b929407990be007e5260133a920218d19e407f5ec5530
Opcode Fuzzy Hash: 07eba3370d4ed5524ad699d1058730ea3ff6ec5bc7e028c01b4af5dc36804711
Instruction Fuzzy Hash: 72117C70A0020A9FCB54EBBED51462A7BE6EF88204B1408B8D509CB354EA34DD42CB91

Function 06F5A9B0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e95d9df7aec08fca7350412bea23fe88e2ee78c0d44404e5412c13dbc3315333
Instruction ID: 5e13648d1f861a7813424e11f247bb58f75f04ba6302a89ed9f71b41b24665e7
Opcode Fuzzy Hash: e95d9df7aec08fca7350412bea23fe88e2ee78c0d44404e5412c13dbc3315333
Instruction Fuzzy Hash: 0411C870A002069FCB44FB78E45099DBBF6EF81318B104769C1059B295EB359E0ACFD1

Function 06F60AA8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303059087.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f60000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195447ff300deb97ced9de55258e95683a8c81ad8c3062112949a9e42089d319
Instruction ID: 1c9e790b14292ebf21ac53d21bce114ced2cedd2cd4028c6156e6c20cf1300a5
Opcode Fuzzy Hash: 195447ff300deb97ced9de55258e95683a8c81ad8c3062112949a9e42089d319
Instruction Fuzzy Hash: 7E110E71E28245AFC788DF26D9A551EBBB2EFC1208F24C4A9E016C73A0DF349D81CB44

Function 06F53339 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db4616ebc372344fcc0015d082d60a8f7494101ca086c3591bd0d6a57ff4898
Instruction ID: c764996f5f00f9d9538a3c832e26a12524fe411b27e9abe3c9d9d2653f396e0a
Opcode Fuzzy Hash: 0db4616ebc372344fcc0015d082d60a8f7494101ca086c3591bd0d6a57ff4898
Instruction Fuzzy Hash: A3012B33701214AFC7115B5DE88486AFB9EEB84360307816AEA09C7311DF21EC0587D6

Function 06F57EA0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e0188eec9627d34074d33bbfdbf8ee9a650a547103b629419e4bf02b245147
Instruction ID: f17a62c6bd02c7c331440fd4abb413baddb0a263b27a599a8097af365244cd91
Opcode Fuzzy Hash: 37e0188eec9627d34074d33bbfdbf8ee9a650a547103b629419e4bf02b245147
Instruction Fuzzy Hash: 0B118E716002069FD7549F25E444E9AFBFAFF88320B018569EA098B365DB30ED05CB90

Function 06F57E99 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a9f7e6edf5538459824b1988461b818aca04b3d949f0d33ee9853272b21bf0d
Instruction ID: 8733a162783f8b4196d562c2e9c168636407719f7e8447a0e7691ef6fd41da85
Opcode Fuzzy Hash: 2a9f7e6edf5538459824b1988461b818aca04b3d949f0d33ee9853272b21bf0d
Instruction Fuzzy Hash: 8111A571600205DFD714DF24E444E5AFBF6FF88320B018569EA498B355DB70DD45CB90

Function 06F32F03 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74eae9a6b7e37c2b731fc1e1275b05dced181d983d9218d866be9c8e27153956
Instruction ID: a4dd7be06b89159634eb858b3db5b31f6f575ebc47ef402488a28003234cea7f
Opcode Fuzzy Hash: 74eae9a6b7e37c2b731fc1e1275b05dced181d983d9218d866be9c8e27153956
Instruction Fuzzy Hash: 0301A2397046518FC745D63EDC148AA7BEA9FCA66171581B6F205CB3B1EAB0DC028B90

Function 073EDFA8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303458791.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c152e1f28dcccd9de405386f8f37f019935c9e6e451ed6a2b73a24dcb745a82b
Instruction ID: 13d506665bb9d06ae1599f3ad0a78a9e928dbc01b305056139f102bff72b224f
Opcode Fuzzy Hash: c152e1f28dcccd9de405386f8f37f019935c9e6e451ed6a2b73a24dcb745a82b
Instruction Fuzzy Hash: 6D1151302007055FC729DB28E980C5ABBABEFC02147148A2DD05A8F369EB71ED0AC791

Function 06F3ED58 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec627f24eec0f31ec39187502a005490baa61f83b660a9936d0938b3354572a1
Instruction ID: bf817fa411e993fb345f86975e9aeb2e600cd0cb84a102526d95685e6ffa28e3
Opcode Fuzzy Hash: ec627f24eec0f31ec39187502a005490baa61f83b660a9936d0938b3354572a1
Instruction Fuzzy Hash: 56115E35A10116DFCF44DFA4D9488AEBBFAFFC82117108429EA06D7354D6309901CBE1

Function 06F50C40 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4512ec525074160a58f033a438c185720d443128f0789bf70b5edb8b0f061d9a
Instruction ID: 725e0b33280ca0dda1f39d852be3ce5f6b36df16a79db5f2c3ff42f037cea84a
Opcode Fuzzy Hash: 4512ec525074160a58f033a438c185720d443128f0789bf70b5edb8b0f061d9a
Instruction Fuzzy Hash: 09115E35600209DFCB44DF68D884D9EBBF6FF89324B158169E9498B362DB71ED06CB90

Function 06F34451 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f24b3d18c38f073605d1352422e6e471ccfcdb455588c97c07095f06d8b0e11c
Instruction ID: 5cbc1566e8cdd1775b6c36ef956126a7f2ed14e1bd26e64214d09dc3251d13eb
Opcode Fuzzy Hash: f24b3d18c38f073605d1352422e6e471ccfcdb455588c97c07095f06d8b0e11c
Instruction Fuzzy Hash: 670165352057054FC725DF29E990C8B7BEAEF85310B008629E4458B675DB74ED09CBA1

Function 02CA37E9 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d36b830cfe947405e79282863b087ed0feb3af6d6220d03b62164bc84cb47ade
Instruction ID: 23a11084f02af01103552bacec30c31ddc7a56dc735889b448c0704b4ef6fde9
Opcode Fuzzy Hash: d36b830cfe947405e79282863b087ed0feb3af6d6220d03b62164bc84cb47ade
Instruction Fuzzy Hash: 9C018F313042808BC729AA39A9E5B7E76D7AFC9399B05497DD04ACB755CF74CC068742

Function 06F5A240 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f294562ac18b6f315f518eb828bb2add90c3d9815ea9af4b460a718e325339
Instruction ID: 4103f68f4cd5d0d1aed80403077294e90c895afeff06ed855271f97e7e11ef3a
Opcode Fuzzy Hash: 62f294562ac18b6f315f518eb828bb2add90c3d9815ea9af4b460a718e325339
Instruction Fuzzy Hash: C001F232F046354F8B659A66998092FB7A9AB89A103060219CE499B340DF35EC0287D1

Function 06F60AE0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303059087.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f60000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27b7a1824ebcfc3c68f9dab483ebb1e7827d4147efdc8df8c13b439adf736c88
Instruction ID: 21aaf2a1f212088593a597d4d169f64bbbeb3cec4da7fce08c6d3eaefa70c5d6
Opcode Fuzzy Hash: 27b7a1824ebcfc3c68f9dab483ebb1e7827d4147efdc8df8c13b439adf736c88
Instruction Fuzzy Hash: 05113070D14209EFDB84DF6ADA9569DBBF5EB84304F20C4A9D406E7250EF745E40CB44

Function 06F5ACF8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ae094a5bb546c82e4c1039f4f04b2cba49d1df1b226deefc857ff2f948a0ff
Instruction ID: 85d0f7a4e20fcada43cb534625f304871191e6a8438701036d99323a513c4a14
Opcode Fuzzy Hash: e7ae094a5bb546c82e4c1039f4f04b2cba49d1df1b226deefc857ff2f948a0ff
Instruction Fuzzy Hash: ADF0F9B1A041175FE3516AA6D8407BBBB5FAFC5711F160065DF49C7241DA288C0387F2

Function 06F37000 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee1a4ba3e8b7ac02cc20318d3fb824f7ae0daa50fac6f02cd1ad340e4352224
Instruction ID: 700e025f26d2450759f324de67ec8f946382fc7ab922016a5fa5631758aba47e
Opcode Fuzzy Hash: 4ee1a4ba3e8b7ac02cc20318d3fb824f7ae0daa50fac6f02cd1ad340e4352224
Instruction Fuzzy Hash: 5501D2312006068FC725DF29E980D4BBBE9FF843507008A29E4468B625DB75FD09CB90

Function 02CA37B8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ac42d08f46c8520bf02bf07dd6857713300e9e2dc2eed05a608e21b7e77cf0
Instruction ID: 33978f5027410348e4eda1ee1b55a980dab4588df84356982af01b19a3dc8406
Opcode Fuzzy Hash: 33ac42d08f46c8520bf02bf07dd6857713300e9e2dc2eed05a608e21b7e77cf0
Instruction Fuzzy Hash: B2F0C2313442404B8B69BB3C55F4A3D7693AFD9289315483DD54BCB365DF35CC0A9742

Function 02CAB868 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c614e91120e31a563ab0b4bf8cecfb3ca6a05df1ba883ef89352fb99dacde511
Instruction ID: 20dc9fd2af8639d0e071c45a64cfe878f892b3ae0e41934a1209a64aca782341
Opcode Fuzzy Hash: c614e91120e31a563ab0b4bf8cecfb3ca6a05df1ba883ef89352fb99dacde511
Instruction Fuzzy Hash: B401A731A01209DBE715DA24C82A7EE77B6EB88309F644179D401BB3D1CB769D46CB91

Function 06F34460 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b8c3325e9cb57675a9237a7651c9709648f423cf50ad373821d96e296002fbb
Instruction ID: d0feb82ed9cd6d447d4d9b3fb260086c1f796306752480ee2a988d7fd6917bac
Opcode Fuzzy Hash: 4b8c3325e9cb57675a9237a7651c9709648f423cf50ad373821d96e296002fbb
Instruction Fuzzy Hash: 4E01D2352006058FC725DF2DE994D4BBBEAEF85350B008629E44A8B775EB75FD09CB90

Function 073EA370 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303458791.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 173f9dec3e0ebb14103c83d3465389d89e580e95505b931bd69efcd8b692de34
Instruction ID: e7400f1361ad5dad9f6deab8f59195da9c8ea3b6e8b80fbde75f446a6f1fbf7b
Opcode Fuzzy Hash: 173f9dec3e0ebb14103c83d3465389d89e580e95505b931bd69efcd8b692de34
Instruction Fuzzy Hash: D1F0B4B7B0023667F711044B5850BBF7A8BDBC4661F098126FE0A86280D926CD5192A0

Function 06F3BF4D Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eba4da5426ca3fe7f11da711523f737553c75399aafed25d22d1c0d3beb7e13d
Instruction ID: c749f3ce874e693bd4eb8ffdb0acb717f0cf77d478e200e520472a766495f471
Opcode Fuzzy Hash: eba4da5426ca3fe7f11da711523f737553c75399aafed25d22d1c0d3beb7e13d
Instruction Fuzzy Hash: 81F0243620E3A55FD3628B7A9C606963FE8DE8327530940FBE0C4C71E3D524C904CBA0

Function 02CA8D68 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25cd28fe489e849de073312447861c13117c6f59e079a3f781bb4b2c766bc74c
Instruction ID: afb30ae4061ac39e61b1845121a75f8cb8a3598f26f6251d2670bcf6c22420ff
Opcode Fuzzy Hash: 25cd28fe489e849de073312447861c13117c6f59e079a3f781bb4b2c766bc74c
Instruction Fuzzy Hash: 5C111EB48002498FCB20DF9AC584BDEBFF4EF48324F208459D929A7250C338A944CFA1

Function 02CA8D60 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f3a8809c2f79b870c569501e51ea85d9d5237d0d5292f8c7d1e689f2ff20276
Instruction ID: bffba3369fa8479db428db0026cd76022045d249458beb416306850cb8e6e386
Opcode Fuzzy Hash: 1f3a8809c2f79b870c569501e51ea85d9d5237d0d5292f8c7d1e689f2ff20276
Instruction Fuzzy Hash: 4B11EEB5D002498FCB10DF99D685BEEBBF4EF09324F20885AD529B7650D338A644CFA1

Function 06F52000 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b44e9fe5720ba201b5ce45a27cb2ef3773f1cdcf5720b64ebdc3e4c5f0296461
Instruction ID: d3818ad11e846700ffb5f7b5da6b1c097e565a501033ca62e8daeacb9ef5ddf9
Opcode Fuzzy Hash: b44e9fe5720ba201b5ce45a27cb2ef3773f1cdcf5720b64ebdc3e4c5f0296461
Instruction Fuzzy Hash: E2F0B432F092158F9B489FA9B8144AA7BEAEB4417171500ABE50DC7250EE31D941C781

Function 073D55EB Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303458791.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7720d0b81736bfb3408251a326fcd37e3c86add694af25f70d47626e85944e8
Instruction ID: f450454d8fbf636af40aca1681757bd73396e77fb3f636b74c31bd7803123fee
Opcode Fuzzy Hash: a7720d0b81736bfb3408251a326fcd37e3c86add694af25f70d47626e85944e8
Instruction Fuzzy Hash: 0B11D378A002188FCB94DF58CC90B9ABBB2FB89308F1041D9D409A7384DB39AE81CF51

Function 02CACF20 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb0fb6be1052ff6c61a75e25fbd763b6654f319f748ca23135efd00239091baa
Instruction ID: 01f50d717cc2f618e578ec7dfa51f5d4de941e792912f991478ff047a75f5256
Opcode Fuzzy Hash: eb0fb6be1052ff6c61a75e25fbd763b6654f319f748ca23135efd00239091baa
Instruction Fuzzy Hash: C9F0E9B3E051269FDF40DEA99C44BEFBBAAFB88315B054577E509E3100E7354A028394

Function 02CAB5E8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef761239b74070b9d3fa5ccb31871d8a3f2269ea9d1eacea98e252664bcc5886
Instruction ID: 28e303f6ef1377702e5948a7905407959ccfa3c0a1e5d947bd35ccf05553ddec
Opcode Fuzzy Hash: ef761239b74070b9d3fa5ccb31871d8a3f2269ea9d1eacea98e252664bcc5886
Instruction Fuzzy Hash: 0F01AD71A0025ACBDB19DFA4C5657EE77F2BB48708F24096DC402B7394CB7A4C05CBA1

Function 06F5AD08 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eaadb738b51e229ed0f0d85a30d2ef5531a933623c8bb7c5bea536efe8dc7ea
Instruction ID: 52ba35239c1350e3027f7263fd697069fe05cb5bb7d4ba5a41edc748740949d6
Opcode Fuzzy Hash: 6eaadb738b51e229ed0f0d85a30d2ef5531a933623c8bb7c5bea536efe8dc7ea
Instruction Fuzzy Hash: AEF096B2A0411B4BE3546AA6D40477AB29FABC4752F160135DF0AC7340D92C8C1246E2

Function 06F60611 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303059087.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f60000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db74503c801c926d387886bde62e1ab140a65a0223f4b3a7791c968bd8ae950a
Instruction ID: 4d82b3c0adc1ae8bef1fcf164ea631a3059716a493bb2361f5ef133d185e0f5b
Opcode Fuzzy Hash: db74503c801c926d387886bde62e1ab140a65a0223f4b3a7791c968bd8ae950a
Instruction Fuzzy Hash: D4F0E97190E288AFC742CF64CD5049C7FB4DF4B210B1940D7D848CB592EA395E01CB92

Function 06F32F10 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a58dbbd5fff457be45c9f93ed2a501923dcaef428c2e5103911a4118d2de4e1
Instruction ID: 3abc33ca769a7a9e5e25df8b176f6cef6ea37eafa553d2cfac113490fbecb44a
Opcode Fuzzy Hash: 7a58dbbd5fff457be45c9f93ed2a501923dcaef428c2e5103911a4118d2de4e1
Instruction Fuzzy Hash: B0F0F8397506108FC748DB3ED85886977EBAFCE66131590B9E60ACB774EEB0DC028A50

Function 02CAB878 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71cae1031dce33d98cc0e2e2d5570922cb6f2ef8b04ef920e28a04e00c1ff0e3
Instruction ID: aa883f1343f9e1aa8380c42a526cb67b14b009a91eb555d2cc45022f6950ce83
Opcode Fuzzy Hash: 71cae1031dce33d98cc0e2e2d5570922cb6f2ef8b04ef920e28a04e00c1ff0e3
Instruction Fuzzy Hash: 99F08C30A01209DBE7249A64C529BEE77B6FB88308F200169D5016B380CBB75D41CBA1

Function 06F5F3CA Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9fa097e02fd73d03896f7ac8f8854089561a5dda044f4e11822c4d6aaa8442
Instruction ID: 2cefe4f3fb2efa732f19459c1aff2f4725f76496ad561f7e7ed15ba9c82f285d
Opcode Fuzzy Hash: 5a9fa097e02fd73d03896f7ac8f8854089561a5dda044f4e11822c4d6aaa8442
Instruction Fuzzy Hash: 15F062B140A384AFC703CB60C950499BFB5AF4B20471584E7D984CB1A3E6366D16DB62

Function 02CAB5F8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c5f94d506057b952041ffca9a713994d1406076bc698ebd859378f7107f02d6
Instruction ID: 1e6e6111ccab1bd44b8612aa3e16e6f784a2d995070d1852b2dca5013b809ca1
Opcode Fuzzy Hash: 9c5f94d506057b952041ffca9a713994d1406076bc698ebd859378f7107f02d6
Instruction Fuzzy Hash: 58F08C30A0025ADBDB18DFA8C524AEE77F2BB8C708F100529C402A7394CF7A5C45CBA5

Function 06F52070 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b9f27aa3137cba909580c487e1f008f21db5b8bc200069fe3f08456d72a1918
Instruction ID: de27e77dbf40c0a3e1eec6bccc2f8afecce8cfc36b0e7ed04d06454a2d28030b
Opcode Fuzzy Hash: 4b9f27aa3137cba909580c487e1f008f21db5b8bc200069fe3f08456d72a1918
Instruction Fuzzy Hash: B4F02011B0A3A54FC7062678087406EBFA68BC6210B9A51E7C507CB38ACD288D02C3A2

Function 06F34C83 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ec77e1bd3d45d3b241ee90e599f69dc3a7d50dba26779f540f0fbbcb242aa4
Instruction ID: 0a5ae662303b1359386a02e37a3d916e515ae0311810506b9b48e4cfe6a124be
Opcode Fuzzy Hash: e8ec77e1bd3d45d3b241ee90e599f69dc3a7d50dba26779f540f0fbbcb242aa4
Instruction Fuzzy Hash: 44F0E2327093909FC3228F6AEC00853BFFAEF8625031945ABE549C7316DA20EC08C771

Function 02CACF30 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93ac54f1862fb959928a75be669af278499eb9a944370ed7cf90d3bcbff367a5
Instruction ID: 41ad452ef0880b75473716550547c0c82aa75c44f85615114874f4e6206ef4cd
Opcode Fuzzy Hash: 93ac54f1862fb959928a75be669af278499eb9a944370ed7cf90d3bcbff367a5
Instruction Fuzzy Hash: 6EF0A773E041299FCB54DE9A9C44AAFBBAAFBC8264B054537E509D3100D7354A018794

Function 073E6518 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303458791.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0b27066005bf2cb747e105826eec82197c915fc0940216079097aa38af1ff7e
Instruction ID: f8d4a553d1ef4676ab7b08066b73e3692b2c7c05865972eae1f01b33c8753449
Opcode Fuzzy Hash: c0b27066005bf2cb747e105826eec82197c915fc0940216079097aa38af1ff7e
Instruction Fuzzy Hash: F1E048613042182BD30C696F6CA5B6BD99FEFC5B50F14843EA54DCB395CC658C0543E4

Function 06F532F9 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f6ba23e69c73b5c1c67912c24c6e7b65c8288c1df4dd62d50555f59b00e7b52
Instruction ID: d20999e6042c957774a47afd00d624f5fc72405e5e95646c42f1b90f053e1e2e
Opcode Fuzzy Hash: 1f6ba23e69c73b5c1c67912c24c6e7b65c8288c1df4dd62d50555f59b00e7b52
Instruction Fuzzy Hash: 5CE0D8367052556B8311162E789441FBFEEEFC913031501BBE654C3391ED608C0582E6

Function 06F5C210 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e435b7b440601a78ed1b416e8916aec235b741d1c6c88afebd4d50c195cac0
Instruction ID: b9cab289f2e0a45875153eca355ca9d50ce331f2a18ef3f3fcb79df274226005
Opcode Fuzzy Hash: b2e435b7b440601a78ed1b416e8916aec235b741d1c6c88afebd4d50c195cac0
Instruction Fuzzy Hash: DDF0A07051830DEFCB60CFF8E804695BBF5EB0E340F1248AADE86C2101E6314E54E792

Function 06F58391 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebd594d00889982e78df29a866bfafe3527d4aa486c52f997f6d26dc987228b5
Instruction ID: 09c7908cd7342be0377e6660a78591ec3b01a9895ff9d56a6adb6b79ac851d29
Opcode Fuzzy Hash: ebd594d00889982e78df29a866bfafe3527d4aa486c52f997f6d26dc987228b5
Instruction Fuzzy Hash: BFF0E5313062658FC7258F15E915875BFE4AF8928130747DAD9C4CB293C634CD08C791

Function 06F34EB0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3302964027.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f30000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e4cb8c05b48dc7e7e51035c7dc5454d6a9fbd920200419d58834e6946b56b53
Instruction ID: 3dccce92182b528ab9b0681c1d65fff1cb4a9edabfbb815f74ac55cce070c83a
Opcode Fuzzy Hash: 8e4cb8c05b48dc7e7e51035c7dc5454d6a9fbd920200419d58834e6946b56b53
Instruction Fuzzy Hash: 9DE046363001289BCB209A4EE404D9ABBAEDBD9771B048077FA08CB320CA71DC52C7A4

Function 02CA0E80 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d43d56ab67ae856a00d1b2e3e376cb24a9635d7567df8455698440737aa3fd5
Instruction ID: ef355afd3ed23bed58e9ee615cf4a54415e3d784d20bdecfe60c709e82fcba7e
Opcode Fuzzy Hash: 7d43d56ab67ae856a00d1b2e3e376cb24a9635d7567df8455698440737aa3fd5
Instruction Fuzzy Hash: F5E08C313001005F83449A2EA88485AB7DBEBC922531544BAE10DC7325CD60DC024790

Function 06F5F3F0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b50cebe43768792c9768cf0768d5abb71229c52423d3e6614a560656803b228e
Instruction ID: 05060e58b3bca5baee7929c7542a2b97790338523455a8504902a294789b8819
Opcode Fuzzy Hash: b50cebe43768792c9768cf0768d5abb71229c52423d3e6614a560656803b228e
Instruction Fuzzy Hash: 4FE0DF70445288AFCB03CBB489104ADBFB8AF4710030241E2D844DB591E6340E26D7A2

Function 06F5AEF8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2344d9f6105c117a82a424adcd06de36a2fe4452cf5f318cd0a3a93ef831cee1
Instruction ID: bceeef91dddfcfe390c151b5f4c3978f15f0be977eac565ec2d9b3709e7d4534
Opcode Fuzzy Hash: 2344d9f6105c117a82a424adcd06de36a2fe4452cf5f318cd0a3a93ef831cee1
Instruction Fuzzy Hash: AAE086B084A34EAFC742DFA4DD0458ABFFADF0A21072145DAE9C5C7211EA354E149BE2

Function 06F5C220 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cac3ac6807fd9aaa4bbf76b01c58a5cf41f03527108eaac923ec91be1f1ade2
Instruction ID: a6c3aa8e83b22853697e2d99989145e37d0b30d56c02e846f725fc88473e133a
Opcode Fuzzy Hash: 2cac3ac6807fd9aaa4bbf76b01c58a5cf41f03527108eaac923ec91be1f1ade2
Instruction Fuzzy Hash: 51E04F7191430DEFCB90CFB8E8047AA77E9E709311F11586ADE06C2100E6358E50E756

Function 06F53308 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb74ebb6ca475c3428e99ecf4cbd64b613e3f827285b58d89a2912ed7ee51e78
Instruction ID: 78ab4e047ead1b464f8a4db581fbf15eb660abbc8cdce7ef17fdc36cb6f71b8e
Opcode Fuzzy Hash: cb74ebb6ca475c3428e99ecf4cbd64b613e3f827285b58d89a2912ed7ee51e78
Instruction Fuzzy Hash: D9D05E32704122171614155E788882BBBCFD7CC565354007AFA09C3304ED90CC024292

Function 06F615D0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303059087.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f60000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17c5b56742fe12dcee11a62ce360984e9c45fc3ffd5a543f772ef7893ee8fb24
Instruction ID: 752eddb38ca5c9f580c9a2ec3f5f68e1908832b5adc2d17f988eab04e8a2f408
Opcode Fuzzy Hash: 17c5b56742fe12dcee11a62ce360984e9c45fc3ffd5a543f772ef7893ee8fb24
Instruction Fuzzy Hash: F5E08CA4A096D06FC313C629C8A4471BFA6EF9B14035984EAE4C5CB36AD726E827D350

Function 06F5C060 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ef05bf83243b233486febebf2d3d569f43b638e27d0b5e4b2237bd5597fc962
Instruction ID: 2b9964698d797ac8334562b3f3dafbf6a3e294eab70d511b5299a03797a90483
Opcode Fuzzy Hash: 8ef05bf83243b233486febebf2d3d569f43b638e27d0b5e4b2237bd5597fc962
Instruction Fuzzy Hash: 64E0EC74109251AFD612DA54D854892BFA5AF8A200715888FE4D0C7252CA629C1AC7A1

Function 073EED78 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303458791.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4427f96b715143c5a707659722435fb800a800b1892344e77c105742e742840c
Instruction ID: 1be22ead9bb23a5bfa7e642e3178af5b9ff95e0ce728a20d1b32343c496b5d94
Opcode Fuzzy Hash: 4427f96b715143c5a707659722435fb800a800b1892344e77c105742e742840c
Instruction Fuzzy Hash: 95E09270E0430CAFCB44EFA8E54559DBBB9AB48300F0085A9E809E7354EA746A098F81

Function 02CABD57 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20052a8cdb04b10406296da8651ae095452f7a6e5c6cba3919e2b53f6f83999f
Instruction ID: bf8e566295cae8bdc2d1f92cdb16d68cc23b4f97f4baf76bc1e93fdd4824f9c6
Opcode Fuzzy Hash: 20052a8cdb04b10406296da8651ae095452f7a6e5c6cba3919e2b53f6f83999f
Instruction Fuzzy Hash: 55D012B6811108EFC740CFA48A456DA7BA5EB49212F1155A65404E2110EA3A8E11D641

Function 076B13FC Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303538150.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8113fe34f871c293babbd4f68352a5cf8937bec07bb4be5b17084fad7bef9b5
Instruction ID: f9e2aff65189c1b520c0f0e55a50c2d078e40e94c0198024d6049f17f5a7126d
Opcode Fuzzy Hash: c8113fe34f871c293babbd4f68352a5cf8937bec07bb4be5b17084fad7bef9b5
Instruction Fuzzy Hash: 5BE04670608204DFEB21CB28D884BC67BA0EB0A700F1040E5F60A9B2A0D77A8FC0CF01

Function 06F52060 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 948737ba0cac88de87ba3647fad446aa0596a90673c381cc82f98da15b1dc19b
Instruction ID: ba2bed58d103bec07f9875e1de2e5289f798ae4e9a55824299b2eb72e9418adc
Opcode Fuzzy Hash: 948737ba0cac88de87ba3647fad446aa0596a90673c381cc82f98da15b1dc19b
Instruction Fuzzy Hash: 1AD02221E6253C07C3112AB85418C09BBDACBCAB607238AA3E908D3142C9008C4082E0

Function 06F52BBA Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51f1b2e2dec1038c81d9422145afb4cf467bf1ea28e820e01ffefd6f52f3c132
Instruction ID: 1af34f3b426ab08a4124d163058cc3c626578a5b43f2968c3fe63519801e41ad
Opcode Fuzzy Hash: 51f1b2e2dec1038c81d9422145afb4cf467bf1ea28e820e01ffefd6f52f3c132
Instruction Fuzzy Hash: B0D05E35744019CFCB51AF9CE4548E87BA6DF8522174101EADB468B225CB215D118790

Function 02CA25F1 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb2f25f550ac8d1ffd779686de5cdafe25918caae9116f3216c60035c84aefc
Instruction ID: 445b15d3a00a693bfbfd223548ba15848fadc20c84d7ebdecadab08ef892ea92
Opcode Fuzzy Hash: 0bb2f25f550ac8d1ffd779686de5cdafe25918caae9116f3216c60035c84aefc
Instruction Fuzzy Hash: 81D05E305983808FC389CF68D4A4CA93FB8EF9B21030500CED882CB223C2159C16DB11

Function 02CACEEF Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda71750bec333f18362601556cb437d7bad4ad433eed669efb3e12ee0c27528
Instruction ID: 5e3ada3960f596544562e776b2169eb2384f47e95812d21b253fe6b04a73e735
Opcode Fuzzy Hash: cda71750bec333f18362601556cb437d7bad4ad433eed669efb3e12ee0c27528
Instruction Fuzzy Hash: 66D0A9B3A143009BE710DE10E940A42B3A2FF98310F0A8C89A81183B00CB22CC07CA92

Function 06F5F973 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7da0f7cf4b0b050f37c52f18e5a048df571eb6741f2b0dc4fc106d8708b88be
Instruction ID: ca3dd5e9d1858957d9db0b7c544f7d8211929c3a99919a95f01036f6a53533fc
Opcode Fuzzy Hash: b7da0f7cf4b0b050f37c52f18e5a048df571eb6741f2b0dc4fc106d8708b88be
Instruction Fuzzy Hash: D0E01238516219CBDBD06B25E0447693352F7D6764F1601A6CA02D3388CB3C5C81CEC2

Function 076C41E0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303538150.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43d55d0d0a758b79148d54d202922717e397efb4527d4e8b6728f4f234e7b734
Instruction ID: 6adaa11b956cc4a1e03ca968c2568e0bbb26cb5a3685daaa06eec5924b3c7b34
Opcode Fuzzy Hash: 43d55d0d0a758b79148d54d202922717e397efb4527d4e8b6728f4f234e7b734
Instruction Fuzzy Hash: 4CD0C9B194520CEF8B40EFA48E0089EBBEDDB4A200B1045E69908E7260FA315E10AB91

Function 076C2F90 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303538150.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f92e0b134aa247f0a396444105b6d8120deee44b240fc9906e5dd3c5000357a
Instruction ID: 93d6ff4f2fdfa74d3743ed0ff08a0ff2d8e1f1c5f0d46f9c2468733d8fddb58e
Opcode Fuzzy Hash: 0f92e0b134aa247f0a396444105b6d8120deee44b240fc9906e5dd3c5000357a
Instruction Fuzzy Hash: 97D0C9B1A4120CEF8B40DFA8DE0089EBBEDDB8A200B1045E69909E7650EA315E10A791

Function 073E3EC8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303458791.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dba19fe6a2ed8f319631c921485cc4c7fbc0719a692a66283251461c289e860
Instruction ID: 5bafab2153428749f8221f93386d584acb2190f4040cdaee80cf642758ebcf74
Opcode Fuzzy Hash: 1dba19fe6a2ed8f319631c921485cc4c7fbc0719a692a66283251461c289e860
Instruction Fuzzy Hash: 8AD0C97194110CEF8B41EFA4991089EBBFEDB49200B1045E69509D7210F9319B14ABD2

Function 02CABD68 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e380be36db63a82b7d855e2377b9795ac416d38b97e8ff3a5e4cbb1707a17cd
Instruction ID: 2eeb146c614f447079f8c15015f051d28246b5757e618dae8a3339979152e28b
Opcode Fuzzy Hash: 1e380be36db63a82b7d855e2377b9795ac416d38b97e8ff3a5e4cbb1707a17cd
Instruction Fuzzy Hash: EFD0C77594110CEF8700DFA4D90189DBFFDEB49211B1055E6A905D3210FE355A109791

Function 06F5260C Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394a286226e770b0378c8c235f943428ca5566eb56e0685ea8a697bcfbe64312
Instruction ID: c7d0f0f659600d9f1280e3f19cb7512ea6f424220cb63ba3547ed15ee6a18c70
Opcode Fuzzy Hash: 394a286226e770b0378c8c235f943428ca5566eb56e0685ea8a697bcfbe64312
Instruction Fuzzy Hash: B8D0C935B400048F8B84DBADE4544ED7BF5EFC9225B4100AAE60AC7324DB309D118B81

Function 06F5F400 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ff141db541d70a9526f7fbed233cda28ada1da8f84dab3566bbd2f80d85923
Instruction ID: 33ef9351ed35fdf0e34d407cffe3e78cf10dcc9be226dc98777e6f06ee3ab261
Opcode Fuzzy Hash: e8ff141db541d70a9526f7fbed233cda28ada1da8f84dab3566bbd2f80d85923
Instruction Fuzzy Hash: 43D0C9B194120CEF8B40DFE48E0099EBBEDDB4A200B1045E69908EB250EA315F10A7A1

Function 06F5AF08 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ddef32a32549568c72f1fb8a718a3d8d314dde13f1f9452506c222847b99533
Instruction ID: 95559f9cd3c57166facc85bc08ca627a9fb3160b3d01d822a120306bd7829571
Opcode Fuzzy Hash: 1ddef32a32549568c72f1fb8a718a3d8d314dde13f1f9452506c222847b99533
Instruction Fuzzy Hash: 5FD0C7B194110DEF8741DFA4D90045D7BFDDB49210B1045E59505D3310ED355A149BD1

Function 06F5ACC0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 971ef348c58e78374a58812821df765741b29d84fff42ee7f0a98f56bb8fa655
Instruction ID: 7dda6cb080466ba9d082d9aea15743ea41d30a7aa1eb31f9aad4882938b084bb
Opcode Fuzzy Hash: 971ef348c58e78374a58812821df765741b29d84fff42ee7f0a98f56bb8fa655
Instruction Fuzzy Hash: E1C0803000E78E9FC3030BD858445C07FBDDF0E21035104C3E2CC85443E6240456C795

Function 02CAA5AC Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bfef255cba6b8c368307b3e3f3e5d3133b5792289f2515bbc7f3d224dd2fb9b
Instruction ID: 6206cfa10216805a9c5f4393dd802776d560dd07cdb62b9771ecb7f912fbc5d6
Opcode Fuzzy Hash: 9bfef255cba6b8c368307b3e3f3e5d3133b5792289f2515bbc7f3d224dd2fb9b
Instruction Fuzzy Hash: 37D0C9367401148FCB449B78E85889CBBB0FF8822531005B5E119CB271DB3598108A00

Function 06F5F6D0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 967a2d4fc8a25210e148216fb5a1ecf7ab8d757cd93563cb828a71af2f63bd33
Instruction ID: 60f129ff0d61033c03aa277005002b846be93e83a349d38cc30b4c3027778af4
Opcode Fuzzy Hash: 967a2d4fc8a25210e148216fb5a1ecf7ab8d757cd93563cb828a71af2f63bd33
Instruction Fuzzy Hash: 26D012A250E2805FC746C634C4514C47FB0AE4711075E88CBD088CB553E622BB0793D2

Function 06F52874 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e2abfb8e6a2d4eaf147e72787a3130cf70c902cee0bd22737e658b755c4fa58
Instruction ID: bcb0186fcd7158bc4230b7012e364ff2dcca2431bf1240d748ba62ebbde28ce5
Opcode Fuzzy Hash: 8e2abfb8e6a2d4eaf147e72787a3130cf70c902cee0bd22737e658b755c4fa58
Instruction Fuzzy Hash: 26D01239740004CF8744DAACE4144DD77E6DFC521571100A6E707C7635CB30DD51C780

Function 06F5ACE0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d2fdc493642b3830e82a862ecfd50a5a39ab22a6afefac0fc59e8f9770d446
Instruction ID: e7048d1a7db82c6e73d44d1cc083089746c25d1602a42ce0fc14b1af00214b59
Opcode Fuzzy Hash: 57d2fdc493642b3830e82a862ecfd50a5a39ab22a6afefac0fc59e8f9770d446
Instruction Fuzzy Hash: 75C08C7004A2899FCB020B1058A80813F3A9F0A30031B80CAE0C0C1002D728050CCF60

Function 06F60650 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303059087.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f60000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 627b0cc79e5b828082963e45c85ae45d79f2605169ba7d9c62c83971f0186d7e
Instruction ID: e6d5d01d8f874b2e0911452a7ff9218bf0138683e28d0ee64d3f88c26642abf6
Opcode Fuzzy Hash: 627b0cc79e5b828082963e45c85ae45d79f2605169ba7d9c62c83971f0186d7e
Instruction Fuzzy Hash: CCC080B25091504FC3438B14C9511847B30DF9531471C84D99084CF1E7DB39E603CB95

Function 073EED50 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303458791.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3167db0665bfc44246297348daa45b1d49f14205174bf2da2b89cc92a8059399
Instruction ID: f20cb4aa20cc7514c28073ab89714ffbcaf638a3f9660a7aa76e52c23cd2b014
Opcode Fuzzy Hash: 3167db0665bfc44246297348daa45b1d49f14205174bf2da2b89cc92a8059399
Instruction Fuzzy Hash: 9EB0927094530CAF8620DA99A90285ABBACDA0A210B0005D9EA098B320D972A91056D1

Function 02CA0A8F Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc7be4b39e2e258627fe5e9a338e61817d777caaf8d286683f7fd27edae994ad
Instruction ID: ed21d0e7ef49acd66845b517777fa2574b078eb2d9eef9ee77903b4fd96f435b
Opcode Fuzzy Hash: cc7be4b39e2e258627fe5e9a338e61817d777caaf8d286683f7fd27edae994ad
Instruction Fuzzy Hash: 1CC00225684647CED36427A5D52CBAC3E61AB8238AF441166F103494BACA7809009B9A

Function 02CA0A73 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09a7a7701162d0a0716a0bf0d25c6b8238f318b71fa49ae97a3784952e42ca78
Instruction ID: 6aaa79325a712c165df393f12c7dc0473fc5fc90a8b176b2763f21878368db5c
Opcode Fuzzy Hash: 09a7a7701162d0a0716a0bf0d25c6b8238f318b71fa49ae97a3784952e42ca78
Instruction Fuzzy Hash: 11C0022568464BCED76457A5D52CBAC3E61AB8238AF441166F103484BACA780940DB9A

Function 06F5900D Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a2b6c1c6f40b40964128e731d10eb7f64c017911fc35070b04ef01b77c26009
Instruction ID: bd996925195ac0162ed50ebddbdcb99c232e73537baa79a14f9e461bf00b0edd
Opcode Fuzzy Hash: 9a2b6c1c6f40b40964128e731d10eb7f64c017911fc35070b04ef01b77c26009
Instruction Fuzzy Hash: 62B01235B064351B0360565C38058C6B949CB8946530281A2FD05D3304DD244C4202E3

Function 06F58FC9 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b0a6609026f302a5e5e87242032f7001804ff690d9c024d18a73db9813e898b
Instruction ID: 5d505e4251272331f47f96facd93987f12ba82726450f9b8e86e6bddf40aaa96
Opcode Fuzzy Hash: 7b0a6609026f302a5e5e87242032f7001804ff690d9c024d18a73db9813e898b
Instruction Fuzzy Hash: 5BC04C755524448FC750DF29E54CC50BBF4AF5D62431586EDF08DCB623C63194089B00

Function 076C0A18 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303538150.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
Instruction ID: 60a72056a403d9f31dd85fef4a7a76d12bb133d0d450fb6ef353260f5a4d9492
Opcode Fuzzy Hash: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
Instruction Fuzzy Hash: 0BC09274300100AF8348CA18C895C26F7E6EFD8214B24C46DB84DC7365EF32EC03CA10

Function 073E9738 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303458791.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
Instruction ID: 60a72056a403d9f31dd85fef4a7a76d12bb133d0d450fb6ef353260f5a4d9492
Opcode Fuzzy Hash: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
Instruction Fuzzy Hash: 0BC09274300100AF8348CA18C895C26F7E6EFD8214B24C46DB84DC7365EF32EC03CA10

Function 073E3548 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303458791.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
Instruction ID: 60a72056a403d9f31dd85fef4a7a76d12bb133d0d450fb6ef353260f5a4d9492
Opcode Fuzzy Hash: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
Instruction Fuzzy Hash: 0BC09274300100AF8348CA18C895C26F7E6EFD8214B24C46DB84DC7365EF32EC03CA10

Function 073E07F8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303458791.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
Instruction ID: 60a72056a403d9f31dd85fef4a7a76d12bb133d0d450fb6ef353260f5a4d9492
Opcode Fuzzy Hash: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
Instruction Fuzzy Hash: 0BC09274300100AF8348CA18C895C26F7E6EFD8214B24C46DB84DC7365EF32EC03CA10

Function 02CA2600 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef11cab34115df3b79963f8a45df0f4ed50c3d6fe047bbe5518622eaf0674e2b
Instruction ID: 9945d45a52046e18733287943a890528097d37a91000de6a62893cdfee598220
Opcode Fuzzy Hash: ef11cab34115df3b79963f8a45df0f4ed50c3d6fe047bbe5518622eaf0674e2b
Instruction Fuzzy Hash: C4C048352602088F8284EA9AE588C12B7A8FF5CA003410099E9018B722CB21FC10DA61

Function 06F58FD0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
Instruction ID: a0ccf6e4bed68dc0c69f5d0bbd707ad7c253f4111acce2a0e91a8f8d8fd4bd45
Opcode Fuzzy Hash: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
Instruction Fuzzy Hash: 03B092351602088F82409B68E448C00B3E8AB08A243118090E10C8B232C621F8008A40

Function 06F5FCFD Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2095f750136eb96c3a25c7e8d833c68aa22b1b0c5175b4c7c69e62265a8178b7
Instruction ID: 529ae092e3829e84718519c0d5df0cb2a10e600241c526a9699314b0df412558
Opcode Fuzzy Hash: 2095f750136eb96c3a25c7e8d833c68aa22b1b0c5175b4c7c69e62265a8178b7
Instruction Fuzzy Hash: 11B012702004108FC344CF04D440404F3A1EFCA308324C49CA448CB215CF33D803C640

Function 06F532E0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af9843f76e17346dd519b573735acdd4adb35418af927a8b168521e5de14a22c
Instruction ID: 6663a29b3c33019f59d043bbc9126e7e4902bd67b5136e1760a655e9bb98d0c9
Opcode Fuzzy Hash: af9843f76e17346dd519b573735acdd4adb35418af927a8b168521e5de14a22c
Instruction Fuzzy Hash: 59C09230502280CFCB16CF20C0488007B72AF4230635980E8D1098B632C732DC82CB00

Function 076C59C0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303538150.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction ID: 424522431131923360a2424e5b60fcaca403654da384226d21dcd1d1d325544f
Opcode Fuzzy Hash: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction Fuzzy Hash: B3A001746050109B8689DA58D991818B7A2ABC9219728C4ADA819CB25ACF33E9039A44

Function 06F5ACD0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3303010672.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f50000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e21d8ae07cd9aca59e5598a4ac84de45a45b8a3f45ee7546e44889f5add7f9b
Instruction ID: 1a28b5b08bc22c34296aa3fc340df43df0be26231b1c38b69dc5a426b7e48255
Opcode Fuzzy Hash: 4e21d8ae07cd9aca59e5598a4ac84de45a45b8a3f45ee7546e44889f5add7f9b
Instruction Fuzzy Hash: F790027105564E8B554027D974095A5775D96446367800061A60D41601AA6DA45045D5

Non-executed Functions

Function 02CAC508 Relevance: 5.3, Strings: 4, Instructions: 315COMMON

Download Yara Rule

Strings

Te]q, xrefs: 02CAC940
LIZh, xrefs: 02CAC7D2
TJbq, xrefs: 02CAC5A1
xb`q, xrefs: 02CAC579

Memory Dump Source

Source File: 00000004.00000002.3296577814.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_CasPol.jbxd

Similarity

API ID:
String ID: LIZh$TJbq$Te]q$xb`q
API String ID: 0-2805892111
Opcode ID: bb7b5fbd92099a285fc603eadfb5abed48f44415e336aa0a6538b384db55bbbc
Instruction ID: 2f1681574b1fb86043d32865e86d90e49e53d3243f382c803a2ff8443031c285
Opcode Fuzzy Hash: bb7b5fbd92099a285fc603eadfb5abed48f44415e336aa0a6538b384db55bbbc
Instruction Fuzzy Hash: 18C14975E102299FCB14DF68C994BADB7F2BF88304F1581A9E419EB361DB30AE45CB40

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Payment-Order #24560274 for 8,380 USD.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Payment-Order #2_f96334feb1c271282e45732209aa89387a7faf_274b19cb_63f98574-5a4a-4425-87bc-dd148dd85d76\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D2A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5EF0.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F2F.tmp.xml

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_caigfzsp.5pi.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_epbliuql.uib.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jk0pae3c.urc.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wla0tx4j.13k.ps1

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

Windows Analysis Report
Payment-Order #24560274 for 8,380 USD.exe

Function 00007FF848E7DF79 Relevance: 6.7, Strings: 4, Instructions: 1672
COMMON

Function 00007FF848E70C48 Relevance: 4.5, Strings: 3, Instructions: 707
COMMON

Function 00007FF848E87A40 Relevance: 2.4, Strings: 1, Instructions: 1155
COMMON

Function 00007FF848E77F68 Relevance: 2.2, Strings: 1, Instructions: 927
COMMON

Function 00007FF848E87AFA Relevance: 1.7, APIs: 1, Instructions: 195
memoryCOMMON

Function 00007FF848F410C9 Relevance: 1.5, Strings: 1, Instructions: 270
COMMON