Play interactive tour

Edit tour

Windows Analysis Report Payment Notification.pdf.scr

Overview

General Information

Sample Name:	Payment Notification.pdf.scr (renamed file extension from scr to exe)
Analysis ID:	509323
MD5:	06e79cb697e436c1e66c49d3c39dbd82
SHA1:	025758750ef682cead7c98f6cf4156c7bb33a3b2
SHA256:	07749072a852c769fad91c350e6921b811fb04de3448516e2ccf5b81d07e22e7
Tags:	exeNanoCore
Infos:
Most interesting Screenshot:

Detection

NanoCore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Sigma detected: NanoCore

Yara detected AntiVM3

Multi AV Scanner detection for dropped file

Yara detected Nanocore RAT

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Initial sample is a PE file and has a suspicious name

Writes to foreign memory regions

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Executable has a suspicious name (potential lure to open the executable)

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses an obfuscated file name to hide its real file extension (double extension)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

Payment Notification.pdf.exe (PID: 6132 cmdline: 'C:\Users\user\Desktop\Payment Notification.pdf.exe' MD5: 06E79CB697E436C1E66C49D3C39DBD82)

schtasks.exe (PID: 3740 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XDyfQvRGNV' /XML 'C:\Users\user\AppData\Local\Temp\tmpB5A6.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 4720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RegSvcs.exe (PID: 5412 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe MD5: 71369277D09DA0830C8C59F9E22BB23A)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "ed2d5ce0-ca4d-4264-be01-91a018d5", "Domain1": "harold.accesscam.org", "Domain2": "harold.2waky.com", "Port": 6051, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.681190398.0000000003001000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.681509296.0000000004001000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x29efcd:$x1: NanoCore.ClientPluginHost 0x2d17ed:$x1: NanoCore.ClientPluginHost 0x29f00a:$x2: IClientNetworkHost 0x2d182a:$x2: IClientNetworkHost 0x2a2b3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2d535d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.681509296.0000000004001000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.681509296.0000000004001000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x29ed35:$a: NanoCore 0x29ed45:$a: NanoCore 0x29ef79:$a: NanoCore 0x29ef8d:$a: NanoCore 0x29efcd:$a: NanoCore 0x2d1555:$a: NanoCore 0x2d1565:$a: NanoCore 0x2d1799:$a: NanoCore 0x2d17ad:$a: NanoCore 0x2d17ed:$a: NanoCore 0x29ed94:$b: ClientPlugin 0x29ef96:$b: ClientPlugin 0x29efd6:$b: ClientPlugin 0x2d15b4:$b: ClientPlugin 0x2d17b6:$b: ClientPlugin 0x2d17f6:$b: ClientPlugin 0x16783e:$c: ProjectData 0x1bb65e:$c: ProjectData 0x29eebb:$c: ProjectData 0x2d16db:$c: ProjectData 0x29f8c2:$d: DESCrypto
Process Memory Space: Payment Notification.pdf.exe PID: 6132	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Payment Notification.pdf.exe.428fe40.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x429ad:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x429ea:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4651d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.Payment Notification.pdf.exe.428fe40.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x42725:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x429ad:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x43fe6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x43fda:$s2: FileCommand 0x1266b:$s3: PipeExists 0x44e8b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x4ac42:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost 0x429d7:$s5: IClientLoggingHost
0.2.Payment Notification.pdf.exe.428fe40.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.Payment Notification.pdf.exe.428fe40.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42715:$a: NanoCore 0x42725:$a: NanoCore 0x42959:$a: NanoCore 0x4296d:$a: NanoCore 0x429ad:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42774:$b: ClientPlugin 0x42976:$b: ClientPlugin 0x429b6:$b: ClientPlugin 0x1007b:$c: ProjectData 0x4289b:$c: ProjectData 0x10a82:$d: DESCrypto 0x432a2:$d: DESCrypto 0x1844e:$e: KeepAlive
0.2.Payment Notification.pdf.exe.428fe40.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.Payment Notification.pdf.exe.428fe40.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.Payment Notification.pdf.exe.428fe40.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.Payment Notification.pdf.exe.428fe40.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
0.2.Payment Notification.pdf.exe.300bffc.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.Payment Notification.pdf.exe.41a4190.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xfbe3d:$x1: NanoCore.ClientPluginHost 0x12e65d:$x1: NanoCore.ClientPluginHost 0xfbe7a:$x2: IClientNetworkHost 0x12e69a:$x2: IClientNetworkHost 0xff9ad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1321cd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.Payment Notification.pdf.exe.41a4190.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.Payment Notification.pdf.exe.41a4190.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfbba5:$a: NanoCore 0xfbbb5:$a: NanoCore 0xfbde9:$a: NanoCore 0xfbdfd:$a: NanoCore 0xfbe3d:$a: NanoCore 0x12e3c5:$a: NanoCore 0x12e3d5:$a: NanoCore 0x12e609:$a: NanoCore 0x12e61d:$a: NanoCore 0x12e65d:$a: NanoCore 0xfbc04:$b: ClientPlugin 0xfbe06:$b: ClientPlugin 0xfbe46:$b: ClientPlugin 0x12e424:$b: ClientPlugin 0x12e626:$b: ClientPlugin 0x12e666:$b: ClientPlugin 0x184ce:$c: ProjectData 0xfbd2b:$c: ProjectData 0x12e54b:$c: ProjectData 0xfc732:$d: DESCrypto 0x12ef52:$d: DESCrypto
0.2.Payment Notification.pdf.exe.4150370.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x14fc5d:$x1: NanoCore.ClientPluginHost 0x18247d:$x1: NanoCore.ClientPluginHost 0x14fc9a:$x2: IClientNetworkHost 0x1824ba:$x2: IClientNetworkHost 0x1537cd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x185fed:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.Payment Notification.pdf.exe.4150370.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.Payment Notification.pdf.exe.4150370.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x14f9c5:$a: NanoCore 0x14f9d5:$a: NanoCore 0x14fc09:$a: NanoCore 0x14fc1d:$a: NanoCore 0x14fc5d:$a: NanoCore 0x1821e5:$a: NanoCore 0x1821f5:$a: NanoCore 0x182429:$a: NanoCore 0x18243d:$a: NanoCore 0x18247d:$a: NanoCore 0x14fa24:$b: ClientPlugin 0x14fc26:$b: ClientPlugin 0x14fc66:$b: ClientPlugin 0x182244:$b: ClientPlugin 0x182446:$b: ClientPlugin 0x182486:$b: ClientPlugin 0x184ce:$c: ProjectData 0x6c2ee:$c: ProjectData 0x14fb4b:$c: ProjectData 0x18236b:$c: ProjectData 0x150552:$d: DESCrypto
Click to see the 10 entries

Sigma Overview

AV Detection:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe, ProcessId: 5412, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud:

Sigma detected: NanoCore

Show sources

Source: File created

System Summary:

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Show sources

Source: Process started

Author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth, Christian Burkard: Data: Command: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe, ParentCommandLine: 'C:\Users\user\Desktop\Payment Notification.pdf.exe' , ParentImage: C:\Users\user\Desktop\Payment Notification.pdf.exe, ParentProcessId: 6132, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe, ProcessId: 5412

Sigma detected: Possible Applocker Bypass

Show sources

Source: Process started

Author: juju4: Data: Command: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe, ParentCommandLine: 'C:\Users\user\Desktop\Payment Notification.pdf.exe' , ParentImage: C:\Users\user\Desktop\Payment Notification.pdf.exe, ParentProcessId: 6132, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe, ProcessId: 5412

Stealing of Sensitive Information:

Sigma detected: NanoCore

Show sources

Source: File created

Remote Access Functionality:

Sigma detected: NanoCore

Show sources

Source: File created

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.2.Payment Notification.pdf.exe.428fe40.2.raw.unpack

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "ed2d5ce0-ca4d-4264-be01-91a018d5", "Domain1": "harold.accesscam.org", "Domain2": "harold.2waky.com", "Port": 6051, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Multi AV Scanner detection for submitted file

Show sources

Source: Payment Notification.pdf.exe

ReversingLabs: Detection: 31%

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\XDyfQvRGNV.exe

ReversingLabs: Detection: 31%

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0.2.Payment Notification.pdf.exe.428fe40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Notification.pdf.exe.428fe40.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Notification.pdf.exe.41a4190.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Notification.pdf.exe.4150370.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.681509296.0000000004001000.00000004.00000001.sdmp, type: MEMORY

Machine Learning detection for sample

Show sources

Source: Payment Notification.pdf.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\XDyfQvRGNV.exe

Joe Sandbox ML: detected

Source: Payment Notification.pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: Payment Notification.pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe

Code function: 4x nop then jmp 0140BCF4h

0_2_0140BBDF

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: harold.accesscam.org
Source: Malware configuration extractor	URLs: harold.2waky.com

Source: Joe Sandbox View

ASN Name: VDI-NETWORKUS VDI-NETWORKUS

Source: Joe Sandbox View

IP Address: 23.146.242.147 23.146.242.147

Source: global traffic

TCP traffic: 192.168.2.4:49774 -> 23.146.242.147:6051

Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Payment Notification.pdf.exe, 00000000.00000003.666385741.0000000005369000.00000004.00000001.sdmp, Payment Notification.pdf.exe, 00000000.00000003.666577138.0000000005366000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: Payment Notification.pdf.exe, 00000000.00000003.666416654.0000000005369000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com6
Source: Payment Notification.pdf.exe, 00000000.00000003.666577138.0000000005366000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comH
Source: Payment Notification.pdf.exe, 00000000.00000003.666416654.0000000005369000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comTCA
Source: Payment Notification.pdf.exe, 00000000.00000003.666577138.0000000005366000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comal
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Payment Notification.pdf.exe, 00000000.00000003.666577138.0000000005366000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comles
Source: Payment Notification.pdf.exe, 00000000.00000003.666416654.0000000005369000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com~
Source: Payment Notification.pdf.exe, 00000000.00000002.681190398.0000000003001000.00000004.00000001.sdmp	String found in binary or memory: http://www.collada.org/2005/11/COLLADASchema9Done
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Payment Notification.pdf.exe, 00000000.00000003.669081604.000000000141B000.00000004.00000001.sdmp, Payment Notification.pdf.exe, 00000000.00000003.669206454.000000000535C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Payment Notification.pdf.exe, 00000000.00000003.670250615.000000000141B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersX
Source: Payment Notification.pdf.exe, 00000000.00000003.680065727.000000000535C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comB.TTFQ
Source: Payment Notification.pdf.exe, 00000000.00000003.680065727.000000000535C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comf
Source: Payment Notification.pdf.exe, 00000000.00000003.669206454.000000000535C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comnc./t
Source: Payment Notification.pdf.exe, 00000000.00000003.680065727.000000000535C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comot
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: Payment Notification.pdf.exe, 00000000.00000003.666140298.0000000005360000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Payment Notification.pdf.exe, 00000000.00000003.665683660.000000000141B000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnc
Source: Payment Notification.pdf.exe, 00000000.00000003.665676518.0000000005364000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cne
Source: Payment Notification.pdf.exe, 00000000.00000003.665676518.0000000005364000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cntte
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Payment Notification.pdf.exe, 00000000.00000003.668884985.000000000535C000.00000004.00000001.sdmp, Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/#
Source: Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/(
Source: Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/16
Source: Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/=
Source: Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/F
Source: Payment Notification.pdf.exe, 00000000.00000003.666931923.0000000005355000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Kurs
Source: Payment Notification.pdf.exe, 00000000.00000003.667537482.000000000535C000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/N
Source: Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Q
Source: Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0z
Source: Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Payment Notification.pdf.exe, 00000000.00000003.667537482.000000000535C000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/t
Source: Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/k
Source: Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/t
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: unknown

DNS traffic detected: queries for: harold.accesscam.org

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0.2.Payment Notification.pdf.exe.428fe40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Notification.pdf.exe.428fe40.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Notification.pdf.exe.41a4190.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Notification.pdf.exe.4150370.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.681509296.0000000004001000.00000004.00000001.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 0.2.Payment Notification.pdf.exe.428fe40.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Payment Notification.pdf.exe.428fe40.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Payment Notification.pdf.exe.428fe40.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Payment Notification.pdf.exe.428fe40.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Payment Notification.pdf.exe.41a4190.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Payment Notification.pdf.exe.41a4190.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Payment Notification.pdf.exe.4150370.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Payment Notification.pdf.exe.4150370.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.681509296.0000000004001000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.681509296.0000000004001000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample	Static PE information: Filename: Payment Notification.pdf.exe
Source: initial sample	Static PE information: Filename: Payment Notification.pdf.exe

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: Payment Notification.pdf.exe

Static file information: Suspicious name

Source: Payment Notification.pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 0.2.Payment Notification.pdf.exe.428fe40.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Payment Notification.pdf.exe.428fe40.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Payment Notification.pdf.exe.428fe40.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Payment Notification.pdf.exe.428fe40.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Payment Notification.pdf.exe.428fe40.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Payment Notification.pdf.exe.428fe40.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Payment Notification.pdf.exe.41a4190.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Payment Notification.pdf.exe.41a4190.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Payment Notification.pdf.exe.4150370.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Payment Notification.pdf.exe.4150370.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.681509296.0000000004001000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.681509296.0000000004001000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Code function: 0_2_01400138	0_2_01400138
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Code function: 0_2_01401A20	0_2_01401A20
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Code function: 0_2_01401EE8	0_2_01401EE8
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Code function: 0_2_0140012A	0_2_0140012A
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Code function: 0_2_014030DF	0_2_014030DF
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Code function: 0_2_014030F0	0_2_014030F0
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Code function: 0_2_01401A0F	0_2_01401A0F
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Code function: 0_2_01404E86	0_2_01404E86
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Code function: 0_2_01402E98	0_2_01402E98
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Code function: 0_2_01402EA8	0_2_01402EA8

Source: Payment Notification.pdf.exe, 00000000.00000000.662022741.00000000009BE000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameNameIn.exe< vs Payment Notification.pdf.exe
Source: Payment Notification.pdf.exe, 00000000.00000002.681190398.0000000003001000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameTaskNode.dll4 vs Payment Notification.pdf.exe
Source: Payment Notification.pdf.exe, 00000000.00000002.685628683.00000000073B0000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameUI.dll< vs Payment Notification.pdf.exe
Source: Payment Notification.pdf.exe	Binary or memory string: OriginalFilenameNameIn.exe< vs Payment Notification.pdf.exe

Source: Payment Notification.pdf.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: XDyfQvRGNV.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Payment Notification.pdf.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: XDyfQvRGNV.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: Payment Notification.pdf.exe

ReversingLabs: Detection: 31%

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe

File read: C:\Users\user\Desktop\Payment Notification.pdf.exe

Jump to behavior

Source: Payment Notification.pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Payment Notification.pdf.exe 'C:\Users\user\Desktop\Payment Notification.pdf.exe'
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XDyfQvRGNV' /XML 'C:\Users\user\AppData\Local\Temp\tmpB5A6.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XDyfQvRGNV' /XML 'C:\Users\user\AppData\Local\Temp\tmpB5A6.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Jump to behavior

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe

File created: C:\Users\user\AppData\Roaming\XDyfQvRGNV.exe

Jump to behavior

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe

File created: C:\Users\user\AppData\Local\Temp\tmpB5A6.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@6/9@25/1

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: Payment Notification.pdf.scr

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{ed2d5ce0-ca4d-4264-be01-91a018d59d09}
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4720:120:WilError_01

Source: Payment Notification.pdf.exe	String found in binary or memory: $c2808ccb-5ae8-48e8-add6-1570f353a9d0
Source: Payment Notification.pdf.exe	String found in binary or memory: $c2808ccb-5ae8-48e8-add6-1570f353a9d0

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: Payment Notification.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Payment Notification.pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe

Code function: 0_2_014077F4 push eax; retf

0_2_014077F5

Source: initial sample	Static PE information: section name: .text entropy: 7.95381107264
Source: initial sample	Static PE information: section name: .text entropy: 7.95381107264

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe

File created: C:\Users\user\AppData\Roaming\XDyfQvRGNV.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XDyfQvRGNV' /XML 'C:\Users\user\AppData\Local\Temp\tmpB5A6.tmp'

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe:Zone.Identifier read attributes | delete

Jump to behavior

Uses an obfuscated file name to hide its real file extension (double extension)

Show sources

Source: Possible double extension: pdf.exe

Static PE information: Payment Notification.pdf.exe

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 0.2.Payment Notification.pdf.exe.300bffc.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.681190398.0000000003001000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment Notification.pdf.exe PID: 6132, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Payment Notification.pdf.exe, 00000000.00000002.681190398.0000000003001000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: Payment Notification.pdf.exe, 00000000.00000002.681190398.0000000003001000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe TID: 5156	Thread sleep time: -40034s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe TID: 4940	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Window / User API: foregroundWindowGot 696			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Window / User API: foregroundWindowGot 654			Jump to behavior

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Thread delayed: delay time: 40034	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Payment Notification.pdf.exe, 00000000.00000002.681190398.0000000003001000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: Payment Notification.pdf.exe, 00000000.00000002.681190398.0000000003001000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Payment Notification.pdf.exe, 00000000.00000002.681190398.0000000003001000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: RegSvcs.exe, 00000006.00000003.684999280.0000000001104000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Payment Notification.pdf.exe, 00000000.00000002.681190398.0000000003001000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 420000	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 422000	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: D66008	Jump to behavior

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XDyfQvRGNV' /XML 'C:\Users\user\AppData\Local\Temp\tmpB5A6.tmp'			Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe			Jump to behavior

Source: RegSvcs.exe, 00000006.00000003.684999280.0000000001104000.00000004.00000001.sdmp

Binary or memory string: Program Manager.NET\Framework\v2.0.50727\h

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Notification.pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\Payment Notification.pdf.exe

Code function: 0_2_011CA2F6 GetUserNameW,

0_2_011CA2F6

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0.2.Payment Notification.pdf.exe.428fe40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Notification.pdf.exe.428fe40.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Notification.pdf.exe.41a4190.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Notification.pdf.exe.4150370.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.681509296.0000000004001000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0.2.Payment Notification.pdf.exe.428fe40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Notification.pdf.exe.428fe40.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Notification.pdf.exe.41a4190.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Notification.pdf.exe.4150370.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.681509296.0000000004001000.00000004.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	Scheduled Task/Job1	Process Injection312	Masquerading11	OS Credential Dumping	Query Registry1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter2	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Disable or Modify Tools1	LSASS Memory	Security Software Discovery211	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Scheduled Task/Job1	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion21	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection312	NTDS	Virtualization/Sandbox Evasion21	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Hidden Files and Directories1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information13	Cached Domain Credentials	Account Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing2	DCSync	System Owner/User Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	File and Directory Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	System Information Discovery12	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Payment Notification.pdf.exe	31%	ReversingLabs	ByteCode-MSIL.Trojan.APost
Payment Notification.pdf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\XDyfQvRGNV.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\XDyfQvRGNV.exe	31%	ReversingLabs	ByteCode-MSIL.Trojan.APost

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cntte	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.comB.TTFQ	0%	Avira URL Cloud	safe
http://www.carterandcone.comal	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.carterandcone.com6	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.collada.org/2005/11/COLLADASchema9Done	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0z	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.carterandcone.comTCA	0%	Avira URL Cloud	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Kurs	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
harold.accesscam.org	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/(	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/#	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.carterandcone.comles	0%	Avira URL Cloud	safe
http://www.fontbureau.comnc./t	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.carterandcone.comH	0%	URL Reputation	safe
http://www.founder.com.cn/cnc	0%	URL Reputation	safe
http://www.founder.com.cn/cne	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Q	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/N	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/F	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/t	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/=	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/16	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.comf	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/t	0%	URL Reputation	safe
http://www.carterandcone.com~	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/k	0%	URL Reputation	safe
harold.2waky.com	0%	Avira URL Cloud	safe
http://www.fontbureau.comot	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
harold.2waky.com	23.146.242.147	true	true		unknown
harold.accesscam.org	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
harold.accesscam.org	true	Avira URL Cloud: safe	unknown
harold.2waky.com	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cntte	Payment Notification.pdf.exe, 00000000.00000003.665676518.0000000005364000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comB.TTFQ	Payment Notification.pdf.exe, 00000000.00000003.680065727.000000000535C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false		high
http://www.carterandcone.comal	Payment Notification.pdf.exe, 00000000.00000003.666577138.0000000005366000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersX	Payment Notification.pdf.exe, 00000000.00000003.670250615.000000000141B000.00000004.00000001.sdmp	false		high
http://www.tiro.com	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com6	Payment Notification.pdf.exe, 00000000.00000003.666416654.0000000005369000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	Payment Notification.pdf.exe, 00000000.00000003.666385741.0000000005369000.00000004.00000001.sdmp, Payment Notification.pdf.exe, 00000000.00000003.666577138.0000000005366000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.collada.org/2005/11/COLLADASchema9Done	Payment Notification.pdf.exe, 00000000.00000002.681190398.0000000003001000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Y0z	Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comTCA	Payment Notification.pdf.exe, 00000000.00000003.666416654.0000000005369000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.typography.netD	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Kurs	Payment Notification.pdf.exe, 00000000.00000003.666931923.0000000005355000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/(	Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/#	Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comles	Payment Notification.pdf.exe, 00000000.00000003.666577138.0000000005366000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comnc./t	Payment Notification.pdf.exe, 00000000.00000003.669206454.000000000535C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.com	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comH	Payment Notification.pdf.exe, 00000000.00000003.666577138.0000000005366000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnc	Payment Notification.pdf.exe, 00000000.00000003.665683660.000000000141B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cne	Payment Notification.pdf.exe, 00000000.00000003.665676518.0000000005364000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/Q	Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/N	Payment Notification.pdf.exe, 00000000.00000003.667537482.000000000535C000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/F	Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/t	Payment Notification.pdf.exe, 00000000.00000003.667537482.000000000535C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/=	Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/16	Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn	Payment Notification.pdf.exe, 00000000.00000003.666140298.0000000005360000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comf	Payment Notification.pdf.exe, 00000000.00000003.680065727.000000000535C000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/t	Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com~	Payment Notification.pdf.exe, 00000000.00000003.666416654.0000000005369000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.jiyu-kobo.co.jp/	Payment Notification.pdf.exe, 00000000.00000003.668884985.000000000535C000.00000004.00000001.sdmp, Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/k	Payment Notification.pdf.exe, 00000000.00000003.667109208.0000000005356000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Payment Notification.pdf.exe, 00000000.00000002.683336693.0000000006622000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/	Payment Notification.pdf.exe, 00000000.00000003.669081604.000000000141B000.00000004.00000001.sdmp, Payment Notification.pdf.exe, 00000000.00000003.669206454.000000000535C000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comot	Payment Notification.pdf.exe, 00000000.00000003.680065727.000000000535C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.146.242.147	harold.2waky.com	Reserved		46664	VDI-NETWORKUS	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	509323
Start date:	26.10.2021
Start time:	12:06:34
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Payment Notification.pdf.scr (renamed file extension from scr to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@6/9@25/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 1.5% (good quality ratio 0.9%) Quality average: 36.2% Quality standard deviation: 38.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 161 Number of non-executed functions: 5
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 20.50.102.62, 173.222.108.226, 173.222.108.210, 20.54.110.249, 40.112.88.60, 52.251.79.25, 80.67.82.211, 80.67.82.235 Excluded domains from analysis (whitelisted): displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, consumer-displaycatalogrp-aks2aks-useast.md.mp.microsoft.com.akadns.net, eus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, store-images.s-microsoft.com-c.edgekey.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, displaycatalog-rp-useast.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/509323/sample/Payment Notification.pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
12:07:35	API Interceptor	2x Sleep call for process: Payment Notification.pdf.exe modified
12:07:39	API Interceptor	940x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
23.146.242.147	Proof of payment.jpg.exe	Get hash	malicious	Browse
	HxXHmM0T9f.exe	Get hash	malicious	Browse
	Payment Notification.exe	Get hash	malicious	Browse
	Payment Notification.scr.exe	Get hash	malicious	Browse
	Payment Notification.scr.exe	Get hash	malicious	Browse
	Request For Quotation.jar	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
harold.2waky.com	Proof of payment.jpg.exe	Get hash	malicious	Browse	23.146.242.147
	Proof of payment.jpg.exe	Get hash	malicious	Browse	185.19.85.137
	Quotation Request.pdf.exe	Get hash	malicious	Browse	185.19.85.137
	Proof of payment.jpg.exe	Get hash	malicious	Browse	185.19.85.137
	Proof of payment.jpg.scr.exe	Get hash	malicious	Browse	185.19.85.137
	Proof of payment.jpg.scr.exe	Get hash	malicious	Browse	185.19.85.137
	HxXHmM0T9f.exe	Get hash	malicious	Browse	23.146.242.147
	Request For Quotation.jar	Get hash	malicious	Browse	23.146.242.147
	QUOTE.exe	Get hash	malicious	Browse	194.5.98.5
	Payment proof.jpg.exe	Get hash	malicious	Browse	194.5.98.5
	Proof Of Payment.jpg.exe	Get hash	malicious	Browse	194.5.98.5
	Proof of payment.pdf.exe	Get hash	malicious	Browse	194.5.98.5
	Payment.pdf.exe	Get hash	malicious	Browse	91.193.75.29
	Payment Confirmation.exe	Get hash	malicious	Browse	185.165.153.213

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
VDI-NETWORKUS	Proof of payment.jpg.exe	Get hash	malicious	Browse	23.146.242.147
	7WVpng6phO.exe	Get hash	malicious	Browse	156.96.151.237
	hWA2wujmoe.exe	Get hash	malicious	Browse	23.146.242.85
	1gPmnCR2PX.exe	Get hash	malicious	Browse	23.146.242.85
	bvngnTeTxp.exe	Get hash	malicious	Browse	23.146.242.85
	ABzm98MbSD.exe	Get hash	malicious	Browse	23.146.242.85
	7w2oGjbrQR.exe	Get hash	malicious	Browse	23.146.242.85
	5HpbqZ5r7t.exe	Get hash	malicious	Browse	23.146.242.85
	Cu4ltshF0q	Get hash	malicious	Browse	156.96.155.230
	RX2dMHNrPL.exe	Get hash	malicious	Browse	23.146.242.85
	tZz20galQf.exe	Get hash	malicious	Browse	23.146.242.85
	0r22uNk4EF.exe	Get hash	malicious	Browse	23.146.242.85
	WbE13U2I1M.exe	Get hash	malicious	Browse	23.146.242.85
	DW1VgsgHNU.exe	Get hash	malicious	Browse	23.146.242.85
	8TEZmAEx3U.exe	Get hash	malicious	Browse	23.146.242.85
	7HHrcwZjLI.exe	Get hash	malicious	Browse	23.146.242.85
	466XoziOLD.exe	Get hash	malicious	Browse	23.146.242.85
	hVlpEajflR.exe	Get hash	malicious	Browse	23.146.242.85
	0rUkHCgvVf.exe	Get hash	malicious	Browse	23.146.242.85
	HxXHmM0T9f.exe	Get hash	malicious	Browse	23.146.242.147

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Payment Notification.pdf.exe.log Download File
Process:	C:\Users\user\Desktop\Payment Notification.pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	525
Entropy (8bit):	5.2874233355119316
Encrypted:	false
SSDEEP:	12:Q3LaJU20NaL10U29hJ5g1B0U2ukyrFk70Ug+9Yz9tv:MLF20NaL329hJ5g522rWz2T
MD5:	61CCF53571C9ABA6511D696CB0D32E45
SHA1:	A13A42A20EC14942F52DB20FB16A0A520F8183CE
SHA-256:	3459BDF6C0B7F9D43649ADAAF19BA8D5D133BCBE5EF80CF4B7000DC91E10903B
SHA-512:	90E180D9A681F82C010C326456AC88EBB89256CC769E900BFB4B2DF92E69CA69726863B45DFE4627FC1EE8C281F2AF86A6A1E2EF1710094CCD3F4E092872F06F
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Temp\tmpB5A6.tmp Download File
Process:	C:\Users\user\Desktop\Payment Notification.pdf.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1643
Entropy (8bit):	5.191361547203692
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/S7hblNMFp//rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBGVtn:cbhK79lNQR/rydbz9I3YODOLNdq30
MD5:	2F47475C4B4B087C7AA31D5961650D4B
SHA1:	49765D299736594A59E380F27ABCB14ADBD9E2DA
SHA-256:	DD928D2AA2EC67114437376422EE33C321FA972EF4EF6623BE067427178AE1DD
SHA-512:	D1B70CA43C987DFA63C10CA5E3BC39A7488CAE701C2D1F80580BD0F097FCAABE8434071C90C8D4F6EAD127B9C19C2DE7B38EC95429D866E9284901C8CE491A92
Malicious:	true
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	7.089541637477408
Encrypted:	false
SSDEEP:	3:XrURGizD7cnRNGbgCFKRNX/pBK0jCV83ne+VdWPiKgmR7kkmefoeLBizbCuVkqYM:X4LDAnybgCFcps0OafmCYDlizZr/i/Oh
MD5:	9E7D0351E4DF94A9B0BADCEB6A9DB963
SHA1:	76C6A69B1C31CEA2014D1FD1E222A3DD1E433005
SHA-256:	AAFC7B40C5FE680A2BB549C3B90AABAAC63163F74FFFC0B00277C6BBFF88B757
SHA-512:	93CCF7E046A3C403ECF8BC4F1A8850BA0180FE18926C98B297C5214EB77BC212C8FBCC58412D0307840CF2715B63BE68BACDA95AA98E82835C5C53F17EF38511
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+......*....~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
File Type:	Non-ISO extended-ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:dNet:Py
MD5:	4AC1BB475FF573310BF15DC6C31BC846
SHA1:	987F6E543C60DE91F724DF5336089FDB7677BF5A
SHA-256:	07BA14A62BF8EEF8FA8B3BBDD6DD398099EFCAC9039ADDB2F104BEB381CC769A
SHA-512:	45429609143113A18120A8C62AFD9E81B9100E8B381596A94049AD9709404B2E00F71CB1A7894DA1A82EDD4226E7E07CE84B99917309A054A95837EC78C98251
Malicious:	true
Reputation:	low
Preview:	.TYqh..H

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bak Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.501629167387823
Encrypted:	false
SSDEEP:	3:9bzY6oRDIvYk:RzWDI3
MD5:	ACD3FB4310417DC77FE06F15B0E353E6
SHA1:	80E7002E655EB5765FDEB21114295CB96AD9D5EB
SHA-256:	DC3AE604991C9BB8FF8BC4502AE3D0DB8A3317512C0F432490B103B89C1A4368
SHA-512:	DA46A917DB6276CD4528CFE4AD113292D873CA2EBE53414730F442B83502E5FAF3D1AE87BFA295ADF01E3B44FDBCE239E21A318BFB2CCD1F4753846CB21F6F97
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	9iH...}Z.4..f..J".C;"a

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bin Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	5.153055907333276
Encrypted:	false
SSDEEP:	3:9bzY6oRDT6P2bfVn1:RzWDT621
MD5:	4E5E92E2369688041CC82EF9650EDED2
SHA1:	15E44F2F3194EE232B44E9684163B6F66472C862
SHA-256:	F8098A6290118F2944B9E7C842BD014377D45844379F863B00D54515A8A64B48
SHA-512:	1B368018907A3BC30421FDA2C935B39DC9073B9B1248881E70AD48EDB6CAA256070C1A90B97B0F64BBE61E316DBB8D5B2EC8DBABCD0B0B2999AB50B933671ECB
Malicious:	false
Preview:	9iH...}Z.4..f.~a........~.~.......3.U.

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\storage.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
File Type:	data
Category:	dropped
Size (bytes):	426832
Entropy (8bit):	7.999527918131335
Encrypted:	true
SSDEEP:	6144:zKfHbamD8WN+JQYrjM7Ei2CsFJjyh9zvgPonV5HqZcPVT4Eb+Z6no3QSzjeMsdF/:zKf137EiDsTjevgArYcPVLoTQS+0iv
MD5:	653DDDCB6C89F6EC51F3DDC0053C5914
SHA1:	4CF7E7D42495CE01C261E4C5C4B8BF6CD76CCEE5
SHA-256:	83B9CAE66800C768887FB270728F6806CBEBDEAD9946FA730F01723847F17FF9
SHA-512:	27A467F2364C21CD1C6C34EF1CA5FFB09B4C3180FC9C025E293374EB807E4382108617BB4B97F8EBBC27581CD6E5988BB5E21276B3CB829C1C0E49A6FC9463A0
Malicious:	false
Preview:	..g&jo...IPg...GM....R>i...o...I.>.&.r{....8...}...E....v.!7.u3e.. .....db...}.......".t(.xC9.cp.B....7...'.......%......w.^.._.......B.W%.<..i.0.{9.xS...5...)..w..$..C..?`F..u.5.T.X.w'Si..z.n{...Y!m...RA...xg....[7...z..9@.K.-...T..+.ACe....R....enO.....AoNMT.\^....}H&..4I...B.:..@..J...v..rI5..kP......2j....B..B.~.T..>.c..emW;Rn<9..[.r.o....R[....@=...:...L.g<.....I..%4[.G^.~.l'......v.p&.........+..S...9d/.{..H.`@.1..........f.\s...X.a.].<.h...J4...k.x....%3.......3.c..?%....>.!.}..)(.{...H...3..`'].Q.[sN..JX(.%pH....+......(...v.....H...3..8.a_..J..?4...y.N(..D.h..g.jD..I...44Q?..N......oX.A......l...n?./..........$.!..;.^9"H...........OkF....v.m_.e.v..f...."..bq{.....O.-....%R+...-..P.i..t5....2Z# ...#...,L..{..j..heT -=Z.P;...g.m)<owJ].J..../.p..8.u8.&..#.m9...j%..g&....g.x.I,....u.[....>./W...........X...bZ...ex.0..x.}.....Tb...[..H_M._.^N.d&...g._."@4N.pDs].GbT.......&p........Nw...%$=.....{..J.1....2....<E{..<!G..

C:\Users\user\AppData\Roaming\XDyfQvRGNV.exe Download File
Process:	C:\Users\user\Desktop\Payment Notification.pdf.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	457728
Entropy (8bit):	7.631882884601436
Encrypted:	false
SSDEEP:	6144:75UiswNkTzNaIaX++UCEbOUPhM2yXJogC6HVcUGDneVy2vakl3V:FkyX+7OUPh3y5D1cVDneVyYagV
MD5:	06E79CB697E436C1E66C49D3C39DBD82
SHA1:	025758750EF682CEAD7C98F6CF4156C7BB33A3B2
SHA-256:	07749072A852C769FAD91C350E6921B811FB04DE3448516E2CCF5B81D07E22E7
SHA-512:	F2EC81462399525595B8B0210024E80DA782E09F43DAE71156E5567B590C30FC5716218441664E4E142DBD0F2EC888E78706A20466866814A8D4454423B4BE32
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 31%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...(.wa..............0......L........... ........@.. .......................`............@.....................................O........J...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc....J.......J..................@..@.reloc.......@......................@..B........................H........?...A......}.......(J............................................{...."..}......{...."..}......{...."..}......{...."..}......{...."..}........0..8........s....%.Bo.....%.Po.....%.Do.....%.Io.....%.Wo......+...0..8........s....%.oo.....%.+o.....%.-o.....%.o.....%.=o......+..".(.........0.. ..............%.r...p.%.r/..p.%....+..&.(.........0..0.........o#....oO...3..o%....oQ.....+....,....+....+..*.0..0.........o#....o#...3..o%....o%.....+....,....+....

C:\Users\user\AppData\Roaming\XDyfQvRGNV.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\Payment Notification.pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.631882884601436
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Payment Notification.pdf.exe
File size:	457728
MD5:	06e79cb697e436c1e66c49d3c39dbd82
SHA1:	025758750ef682cead7c98f6cf4156c7bb33a3b2
SHA256:	07749072a852c769fad91c350e6921b811fb04de3448516e2ccf5b81d07e22e7
SHA512:	f2ec81462399525595b8b0210024e80da782e09f43dae71156e5567b590c30fc5716218441664e4e142dbd0f2ec888e78706a20466866814a8d4454423b4be32
SSDEEP:	6144:75UiswNkTzNaIaX++UCEbOUPhM2yXJogC6HVcUGDneVy2vakl3V:FkyX+7OUPh3y5D1cVDneVyYagV
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...(.wa..............0......L........... ........@.. .......................`............@................................

File Icon


Icon Hash:	c4d2c4dcf4c6f230

Static PE Info

General
Entrypoint:	0x45cc02
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6177B028 [Tue Oct 26 07:37:12 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v2.0.50727
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5cbb0	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5e000	0x14a00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x74000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x5ac08	0x5ae00	False	0.962613909904	data	7.95381107264	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x5e000	0x14a00	0x14a00	False	0.168276515152	data	4.56109890567	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x74000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x5e1c0	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 100663296, next used block 100663296
RT_ICON	0x60768	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 218103808, next used block 218103808
RT_ICON	0x61810	0x468	GLS_BINARY_LSB_FIRST
RT_ICON	0x61c78	0x10828	dBase III DBT, version number 0, next free block index 40
RT_GROUP_ICON	0x724a0	0x3e	data
RT_VERSION	0x724e0	0x334	data
RT_MANIFEST	0x72814	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2017 - 2021
Assembly Version	1.0.0.0
InternalName	NameIn.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	Project Snake
ProductVersion	1.0.0.0
FileDescription	Project Snake
OriginalFilename	NameIn.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2021 12:07:54.360006094 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:54.463334084 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:54.463505983 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:54.517205954 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:54.637379885 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:54.638669968 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:54.783440113 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:54.783633947 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:54.887315035 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:54.889476061 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.033448935 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.036890030 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.189665079 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.189904928 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.355802059 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.355828047 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.355849981 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.355869055 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.355881929 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.355922937 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.356034040 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.459258080 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.459312916 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.459377050 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.459415913 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.459443092 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.459481001 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.459517002 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.459528923 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.459553003 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.459573984 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.459619045 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.459626913 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.459645987 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.459681034 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.459801912 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.563003063 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.563052893 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.563076019 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.563098907 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.563143015 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.563165903 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.563184023 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.563203096 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.563220978 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.563244104 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.563266039 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.563286066 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.563288927 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.563309908 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.563328981 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.563340902 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.563352108 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.563359976 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.563385010 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.563400030 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.563425064 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.563473940 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.667354107 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.667407990 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.667448044 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.667498112 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.667535067 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.667572021 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.667608976 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.667655945 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.667665005 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.667699099 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.667716980 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.667737961 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.667743921 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.667778015 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.667817116 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.667831898 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.667855024 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.667892933 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.667931080 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.667933941 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.667959929 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.667979002 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.668013096 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.668023109 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.668098927 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.668106079 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.668138981 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.668138981 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.668179035 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.668206930 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.668215990 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.668253899 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.668255091 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.668292046 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.668319941 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.668339014 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.668382883 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.668386936 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.668418884 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.668452024 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.668457031 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.668494940 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.668500900 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.668533087 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.668564081 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.668617964 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.771881104 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.771907091 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.771924019 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.771939039 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.771955013 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.771970987 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.771987915 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772003889 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772016048 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772032022 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772042990 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772053957 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772070885 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772085905 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772085905 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.772102118 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772114038 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.772119045 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772120953 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.772133112 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772145033 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772156954 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772167921 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772178888 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.772181034 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772192955 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772212029 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772228003 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772244930 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772258043 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772274017 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772293091 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772310972 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772322893 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772331953 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.772335052 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772350073 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.772351980 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772357941 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.772365093 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772376060 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772387981 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772401094 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772413015 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772424936 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772444963 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772458076 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772459984 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.772469997 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772481918 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772494078 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772495031 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.772505999 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772517920 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772528887 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772545099 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772557020 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772567987 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772578955 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.772588968 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.772780895 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876048088 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876077890 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876090050 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876102924 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876120090 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876132011 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876143932 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876156092 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876168013 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876179934 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876197100 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876200914 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876209021 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876221895 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876234055 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876236916 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876244068 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876249075 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876250029 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876254082 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876262903 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876276016 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876286983 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876292944 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876305103 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876313925 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876323938 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876339912 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876342058 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876352072 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876363993 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876368999 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876375914 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876385927 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876391888 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876418114 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876431942 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876440048 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876460075 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876463890 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876477003 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876494884 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876494884 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876507044 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876513958 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876532078 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876533985 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876548052 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876554012 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876566887 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876569986 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876589060 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876590014 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876605988 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876609087 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876624107 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876637936 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876645088 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876655102 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876676083 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876684904 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876693964 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876707077 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876718044 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876733065 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876744986 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876753092 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876763105 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876775026 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876779079 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.876796961 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.876827002 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.877123117 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.877140999 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.877154112 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.877192974 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.877197027 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.877218008 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.877218962 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.877230883 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.877254009 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.877279043 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.979613066 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.979809999 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.979850054 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.979954004 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.979960918 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980003119 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980025053 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980048895 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980072021 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980087996 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980108976 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980130911 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980151892 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980170012 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980197906 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980214119 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980227947 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980251074 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980274916 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980283022 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.980284929 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980298042 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.980298996 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980303049 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.980307102 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.980320930 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980343103 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980362892 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980375051 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.980385065 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980406046 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980427980 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980449915 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980462074 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.980473042 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980493069 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980515003 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980519056 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.980536938 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980554104 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980571032 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980577946 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.980590105 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980606079 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980618000 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980628967 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980643988 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980654955 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980669022 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980670929 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.980684996 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.980685949 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980698109 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980710030 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980721951 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980732918 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980751991 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980768919 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980782032 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980787039 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.980804920 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980818987 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980834007 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980849028 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:55.980881929 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:55.980981112 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.083337069 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.083368063 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.083381891 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.083445072 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.083491087 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.083972931 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084000111 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084021091 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084032059 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084033966 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084048986 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084062099 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084099054 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084151983 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084161043 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084183931 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084203005 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084223986 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084225893 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084238052 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084254980 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084273100 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084284067 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084290981 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084301949 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084315062 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084319115 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084335089 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084347010 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084359884 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084376097 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084384918 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084393978 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084403038 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084413052 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084433079 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084446907 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084465981 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084475040 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084487915 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084495068 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084507942 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084526062 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084526062 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084537029 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084562063 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084579945 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084583998 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084597111 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084605932 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084614992 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084633112 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084635973 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084655046 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084671021 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084671974 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084690094 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084703922 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084707022 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084724903 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084728956 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084743023 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084762096 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084764957 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084781885 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084800005 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084805012 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084820032 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084827900 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084839106 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084856987 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084863901 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084875107 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084891081 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084897995 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084909916 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084925890 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084933996 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084944963 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084961891 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084969997 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.084979057 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.084995031 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.085011005 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.085016012 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.085028887 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.085046053 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.085051060 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.085067987 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.085086107 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.085089922 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.085102081 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.085114002 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.085119963 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.085136890 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.085140944 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.085154057 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.085171938 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.085180044 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.085189104 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.085208893 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.085211039 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.085227013 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.085228920 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.085244894 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.085268974 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.085304976 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.236470938 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.278634071 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.419454098 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:07:56.440376043 CEST	6051	49774	23.146.242.147	192.168.2.4
Oct 26, 2021 12:07:56.440481901 CEST	49774	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:01.154654026 CEST	49777	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:01.257055044 CEST	6051	49777	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:01.257220984 CEST	49777	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:01.257953882 CEST	49777	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:01.376698017 CEST	6051	49777	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:01.377218962 CEST	49777	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:01.533457994 CEST	6051	49777	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:01.534100056 CEST	49777	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:01.636567116 CEST	6051	49777	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:01.636696100 CEST	49777	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:01.798857927 CEST	6051	49777	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:01.799087048 CEST	49777	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:01.955429077 CEST	6051	49777	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:02.420809031 CEST	49777	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:02.564698935 CEST	6051	49777	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:02.598298073 CEST	49777	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:02.751913071 CEST	6051	49777	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:02.751988888 CEST	49777	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:02.849613905 CEST	6051	49777	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:02.849971056 CEST	49777	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:02.854129076 CEST	6051	49777	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:02.952279091 CEST	6051	49777	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:02.952444077 CEST	49777	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:03.111432076 CEST	6051	49777	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:03.111516953 CEST	49777	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:03.214149952 CEST	6051	49777	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:03.214243889 CEST	49777	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:03.316620111 CEST	6051	49777	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:03.316709042 CEST	49777	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:03.471000910 CEST	6051	49777	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:03.471102953 CEST	49777	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:03.629672050 CEST	6051	49777	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:03.629789114 CEST	49777	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:03.783344984 CEST	6051	49777	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:04.415687084 CEST	49777	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:04.415764093 CEST	49777	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:08.574501991 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:08.677663088 CEST	6051	49778	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:08.677846909 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:08.680367947 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:08.800535917 CEST	6051	49778	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:08.800640106 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:08.956226110 CEST	6051	49778	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:08.956315994 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:09.059813023 CEST	6051	49778	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:09.059938908 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:09.220829010 CEST	6051	49778	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:09.220989943 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:09.392487049 CEST	6051	49778	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:09.392620087 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:09.548837900 CEST	6051	49778	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:09.548973083 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:09.646971941 CEST	6051	49778	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:09.647147894 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:09.652050018 CEST	6051	49778	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:09.652194023 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:09.750443935 CEST	6051	49778	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:09.794823885 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:09.814320087 CEST	6051	49778	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:09.814450979 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:09.917812109 CEST	6051	49778	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:09.917992115 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:10.021277905 CEST	6051	49778	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:10.021372080 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:10.177711964 CEST	6051	49778	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:10.177836895 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:10.330265999 CEST	6051	49778	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:10.330602884 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:10.487881899 CEST	6051	49778	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:10.488008976 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:10.642729998 CEST	6051	49778	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:10.642838001 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:10.701704979 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:10.798821926 CEST	6051	49778	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:10.803150892 CEST	49778	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:14.994157076 CEST	49779	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:15.097501993 CEST	6051	49779	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:15.098601103 CEST	49779	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:15.186909914 CEST	49779	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:15.305346966 CEST	6051	49779	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:15.305439949 CEST	49779	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:15.455169916 CEST	6051	49779	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:15.455233097 CEST	49779	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:15.561249018 CEST	6051	49779	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:15.607855082 CEST	49779	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:15.637482882 CEST	49779	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:15.799098969 CEST	6051	49779	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:15.872410059 CEST	49779	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:16.035289049 CEST	6051	49779	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:16.036698103 CEST	49779	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:16.189728975 CEST	6051	49779	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:16.189877033 CEST	49779	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:16.303488970 CEST	6051	49779	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:16.305036068 CEST	49779	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:16.408399105 CEST	6051	49779	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:16.408514977 CEST	49779	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:16.566656113 CEST	6051	49779	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:16.566786051 CEST	49779	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:16.671237946 CEST	6051	49779	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:16.671417952 CEST	49779	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:16.774878025 CEST	6051	49779	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:16.775331020 CEST	49779	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:16.939565897 CEST	6051	49779	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:16.939682007 CEST	49779	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:17.096154928 CEST	6051	49779	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:17.096921921 CEST	49779	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:17.251924038 CEST	6051	49779	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:17.252130032 CEST	49779	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:17.280282974 CEST	49779	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:21.518383026 CEST	49781	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:21.621782064 CEST	6051	49781	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:21.622034073 CEST	49781	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:21.784792900 CEST	49781	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:21.904064894 CEST	6051	49781	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:21.947520018 CEST	49781	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:22.052576065 CEST	6051	49781	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:22.109302998 CEST	49781	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:22.421974897 CEST	49781	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:22.580081940 CEST	6051	49781	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:22.580285072 CEST	49781	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:22.752367020 CEST	6051	49781	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:22.753195047 CEST	49781	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:22.908097029 CEST	6051	49781	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:22.908215046 CEST	49781	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:23.007080078 CEST	6051	49781	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:23.007395029 CEST	49781	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:23.011461973 CEST	6051	49781	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:23.061621904 CEST	49781	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:23.110622883 CEST	6051	49781	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:23.110755920 CEST	49781	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:23.285296917 CEST	6051	49781	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:23.286024094 CEST	49781	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:23.389431953 CEST	6051	49781	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:23.405837059 CEST	49781	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:23.509063005 CEST	6051	49781	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:23.509258986 CEST	49781	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:23.658063889 CEST	6051	49781	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:23.658411980 CEST	49781	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:23.814286947 CEST	6051	49781	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:23.814687014 CEST	49781	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:23.970860004 CEST	6051	49781	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:23.971010923 CEST	49781	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:23.997978926 CEST	49781	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:29.581173897 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:29.683571100 CEST	6051	49783	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:29.683975935 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:29.714878082 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:29.833590031 CEST	6051	49783	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:29.833889008 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:29.986293077 CEST	6051	49783	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:29.986450911 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:30.089076042 CEST	6051	49783	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:30.089327097 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:30.251872063 CEST	6051	49783	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:30.252074003 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:30.408139944 CEST	6051	49783	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:30.408319950 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:30.566505909 CEST	6051	49783	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:30.566692114 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:30.678949118 CEST	6051	49783	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:30.679173946 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:30.781325102 CEST	6051	49783	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:30.784996986 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:30.939483881 CEST	6051	49783	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:30.939997911 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:31.043298006 CEST	6051	49783	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:31.043667078 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:31.146219969 CEST	6051	49783	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:31.146410942 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:31.298688889 CEST	6051	49783	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:31.298857927 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:31.454962969 CEST	6051	49783	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:31.455130100 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:31.611253023 CEST	6051	49783	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:31.611407995 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:31.767436981 CEST	6051	49783	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:31.787237883 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:31.939335108 CEST	6051	49783	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:31.939414024 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:32.031483889 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:32.095848083 CEST	6051	49783	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:32.095921993 CEST	49783	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:36.739367008 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:36.841715097 CEST	6051	49815	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:36.841900110 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:36.900036097 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:37.019475937 CEST	6051	49815	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:37.062756062 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:37.082895994 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:37.185628891 CEST	6051	49815	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:37.186543941 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:37.345598936 CEST	6051	49815	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:37.474143028 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:37.642502069 CEST	6051	49815	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:37.895659924 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:38.050220966 CEST	6051	49815	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:38.100805998 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:38.252012968 CEST	6051	49815	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:38.252170086 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:38.408443928 CEST	6051	49815	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:38.408540964 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:38.507679939 CEST	6051	49815	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:38.510643959 CEST	6051	49815	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:38.510766029 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:38.612746000 CEST	6051	49815	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:38.656661034 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:38.662620068 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:38.829919100 CEST	6051	49815	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:38.830125093 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:38.934468985 CEST	6051	49815	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:38.934607029 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:39.040878057 CEST	6051	49815	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:39.041111946 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:39.205554008 CEST	6051	49815	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:39.240591049 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:39.392374992 CEST	6051	49815	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:39.392580986 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:39.548675060 CEST	6051	49815	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:39.548796892 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:39.652726889 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:39.705008984 CEST	6051	49815	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:39.705115080 CEST	49815	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:43.762670040 CEST	49828	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:43.866075993 CEST	6051	49828	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:43.866223097 CEST	49828	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:43.867105961 CEST	49828	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:43.985660076 CEST	6051	49828	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:43.985793114 CEST	49828	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:44.142832994 CEST	6051	49828	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:44.142913103 CEST	49828	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:44.247888088 CEST	6051	49828	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:44.248066902 CEST	49828	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:44.408425093 CEST	6051	49828	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:44.408550978 CEST	49828	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:44.564308882 CEST	6051	49828	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:44.564487934 CEST	49828	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:44.720693111 CEST	6051	49828	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:44.720802069 CEST	49828	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:44.877207994 CEST	6051	49828	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:44.877811909 CEST	49828	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:45.035043001 CEST	6051	49828	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:45.035197973 CEST	49828	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:45.189445019 CEST	6051	49828	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:45.189856052 CEST	49828	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:45.346375942 CEST	6051	49828	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:45.346576929 CEST	49828	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:45.502391100 CEST	6051	49828	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:45.515981913 CEST	49828	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:45.600114107 CEST	6051	49828	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:45.601416111 CEST	49828	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:45.624507904 CEST	6051	49828	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:45.624738932 CEST	49828	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:45.704715967 CEST	6051	49828	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:45.755608082 CEST	49828	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:45.783248901 CEST	6051	49828	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:45.783442974 CEST	49828	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:45.785125971 CEST	49828	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:45.887061119 CEST	6051	49828	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:45.887240887 CEST	49828	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:49.923798084 CEST	49830	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:50.027091026 CEST	6051	49830	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:50.027245998 CEST	49830	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:50.028089046 CEST	49830	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:50.148546934 CEST	6051	49830	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:50.148744106 CEST	49830	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:50.298727989 CEST	6051	49830	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:50.298810959 CEST	49830	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:50.402379036 CEST	6051	49830	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:50.402555943 CEST	49830	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:50.564301014 CEST	6051	49830	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:50.564409018 CEST	49830	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:50.720866919 CEST	6051	49830	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:50.721075058 CEST	49830	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:50.892544985 CEST	6051	49830	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:50.892714977 CEST	49830	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:51.006170034 CEST	6051	49830	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:51.006357908 CEST	49830	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:51.109483957 CEST	6051	49830	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:51.109605074 CEST	49830	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:51.267525911 CEST	6051	49830	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:51.270389080 CEST	49830	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:51.373733044 CEST	6051	49830	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:51.373878002 CEST	49830	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:51.477057934 CEST	6051	49830	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:51.517575979 CEST	49830	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:51.673646927 CEST	6051	49830	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:51.673789978 CEST	49830	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:51.814745903 CEST	49830	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:51.830552101 CEST	6051	49830	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:51.830739975 CEST	49830	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:55.872365952 CEST	49831	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:55.975651979 CEST	6051	49831	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:55.975874901 CEST	49831	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:55.994549036 CEST	49831	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:56.112942934 CEST	6051	49831	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:56.113099098 CEST	49831	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:56.283281088 CEST	6051	49831	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:56.283444881 CEST	49831	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:56.386163950 CEST	6051	49831	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:56.425560951 CEST	49831	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:56.595496893 CEST	6051	49831	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:56.625798941 CEST	49831	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:56.783696890 CEST	6051	49831	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:56.783839941 CEST	49831	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:56.939553022 CEST	6051	49831	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:56.939654112 CEST	49831	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:57.036947966 CEST	6051	49831	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:57.037103891 CEST	49831	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:57.041610956 CEST	6051	49831	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:57.095707893 CEST	49831	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:57.139194965 CEST	6051	49831	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:57.139365911 CEST	49831	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:57.298634052 CEST	6051	49831	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:57.298701048 CEST	49831	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:57.401871920 CEST	6051	49831	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:57.402098894 CEST	49831	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:57.504265070 CEST	6051	49831	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:57.504369974 CEST	49831	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:57.658219099 CEST	6051	49831	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:57.658303022 CEST	49831	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:57.816226006 CEST	6051	49831	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:57.818413019 CEST	49831	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:57.971285105 CEST	49831	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:08:57.972012997 CEST	6051	49831	23.146.242.147	192.168.2.4
Oct 26, 2021 12:08:57.972107887 CEST	49831	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:02.094631910 CEST	49856	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:02.197082043 CEST	6051	49856	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:02.197283983 CEST	49856	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:02.198615074 CEST	49856	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:02.315946102 CEST	6051	49856	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:02.316132069 CEST	49856	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:02.470947027 CEST	6051	49856	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:02.471143007 CEST	49856	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:02.574132919 CEST	6051	49856	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:02.582892895 CEST	49856	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:02.752088070 CEST	6051	49856	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:02.752218962 CEST	49856	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:02.909117937 CEST	6051	49856	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:02.909188986 CEST	49856	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:03.064547062 CEST	6051	49856	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:03.064789057 CEST	49856	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:03.208234072 CEST	6051	49856	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:03.208367109 CEST	49856	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:03.310758114 CEST	6051	49856	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:03.310874939 CEST	49856	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:03.455152035 CEST	6051	49856	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:03.455277920 CEST	49856	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:03.557629108 CEST	6051	49856	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:03.557792902 CEST	49856	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:03.659898996 CEST	6051	49856	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:03.660054922 CEST	49856	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:03.814539909 CEST	6051	49856	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:03.815042019 CEST	49856	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:03.970570087 CEST	6051	49856	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:03.970761061 CEST	49856	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:04.127955914 CEST	6051	49856	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:04.330316067 CEST	49856	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:04.473746061 CEST	49856	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:04.486285925 CEST	6051	49856	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:04.486622095 CEST	49856	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:08.542558908 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:08.644783020 CEST	6051	49857	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:08.645021915 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:08.645817995 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:08.764102936 CEST	6051	49857	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:08.764244080 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:08.923808098 CEST	6051	49857	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:08.926074982 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:09.028601885 CEST	6051	49857	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:09.035051107 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:09.189435005 CEST	6051	49857	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:09.189718962 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:09.345746994 CEST	6051	49857	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:09.345824003 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:09.502093077 CEST	6051	49857	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:09.502298117 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:09.599870920 CEST	6051	49857	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:09.600120068 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:09.604403973 CEST	6051	49857	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:09.604612112 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:09.702645063 CEST	6051	49857	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:09.702896118 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:09.767671108 CEST	6051	49857	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:09.767888069 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:09.861176968 CEST	6051	49857	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:09.861474991 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:09.870388985 CEST	6051	49857	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:09.870687962 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:09.963572979 CEST	6051	49857	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:10.003145933 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:10.018449068 CEST	6051	49857	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:10.019377947 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:10.173683882 CEST	6051	49857	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:10.174473047 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:10.330127954 CEST	6051	49857	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:10.330379009 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:10.441210032 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:10.486232996 CEST	6051	49857	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:10.488322020 CEST	49857	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:14.511440039 CEST	49858	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:14.617835045 CEST	6051	49858	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:14.618002892 CEST	49858	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:14.618761063 CEST	49858	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:14.739706039 CEST	6051	49858	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:14.739810944 CEST	49858	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:14.892637014 CEST	6051	49858	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:14.892774105 CEST	49858	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:14.997184992 CEST	6051	49858	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:14.997472048 CEST	49858	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:15.158085108 CEST	6051	49858	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:15.158186913 CEST	49858	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:15.316917896 CEST	6051	49858	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:15.317287922 CEST	49858	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:15.470843077 CEST	6051	49858	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:15.471371889 CEST	49858	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:15.626921892 CEST	6051	49858	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:15.629826069 CEST	49858	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:15.803002119 CEST	6051	49858	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:15.803195953 CEST	49858	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:15.880467892 CEST	6051	49858	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:15.906331062 CEST	6051	49858	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:15.906491041 CEST	49858	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:16.064517975 CEST	6051	49858	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:16.064845085 CEST	49858	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:16.168200970 CEST	6051	49858	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:16.171478987 CEST	49858	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:16.276792049 CEST	6051	49858	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:16.285593987 CEST	49858	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:16.454935074 CEST	6051	49858	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:16.455100060 CEST	49858	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:16.472955942 CEST	49858	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:20.536899090 CEST	49860	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:20.639044046 CEST	6051	49860	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:20.639234066 CEST	49860	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:20.640253067 CEST	49860	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:20.759797096 CEST	6051	49860	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:20.759936094 CEST	49860	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:20.908269882 CEST	6051	49860	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:20.908368111 CEST	49860	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:21.010710955 CEST	6051	49860	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:21.020009041 CEST	49860	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:21.174621105 CEST	6051	49860	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:21.176810026 CEST	49860	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:21.332381964 CEST	6051	49860	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:21.332499027 CEST	49860	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:21.486273050 CEST	6051	49860	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:21.487370968 CEST	49860	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:21.602315903 CEST	6051	49860	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:21.602601051 CEST	49860	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:21.704713106 CEST	6051	49860	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:21.705156088 CEST	49860	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:21.867002010 CEST	6051	49860	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:21.867261887 CEST	49860	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:21.971844912 CEST	6051	49860	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:22.019865036 CEST	49860	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:22.020303965 CEST	49860	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:22.123334885 CEST	6051	49860	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:22.123565912 CEST	49860	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:22.175580025 CEST	6051	49860	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:22.282929897 CEST	6051	49860	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:22.284343004 CEST	49860	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:22.347506046 CEST	6051	49860	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:22.347718954 CEST	49860	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:22.426840067 CEST	49860	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:22.439306021 CEST	6051	49860	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:22.439490080 CEST	49860	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:22.501872063 CEST	6051	49860	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:22.502026081 CEST	49860	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:26.496629000 CEST	49861	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:26.602025032 CEST	6051	49861	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:26.602268934 CEST	49861	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:26.603084087 CEST	49861	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:26.730240107 CEST	6051	49861	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:26.730639935 CEST	49861	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:26.876945972 CEST	6051	49861	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:26.877764940 CEST	49861	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:26.989917994 CEST	6051	49861	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:26.990051985 CEST	49861	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:27.158341885 CEST	6051	49861	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:27.160245895 CEST	49861	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:27.314430952 CEST	6051	49861	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:27.314826012 CEST	49861	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:27.471146107 CEST	6051	49861	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:27.471293926 CEST	49861	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:27.583154917 CEST	6051	49861	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:27.583365917 CEST	49861	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:27.685782909 CEST	6051	49861	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:27.686252117 CEST	49861	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:27.846616983 CEST	6051	49861	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:27.846729994 CEST	49861	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:27.954915047 CEST	6051	49861	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:27.962101936 CEST	49861	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:28.064529896 CEST	6051	49861	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:28.064641953 CEST	49861	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:28.220673084 CEST	6051	49861	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:28.220805883 CEST	49861	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:28.377198935 CEST	6051	49861	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:28.377419949 CEST	49861	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:28.427767038 CEST	49861	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:32.524811029 CEST	49862	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:32.630727053 CEST	6051	49862	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:32.631460905 CEST	49862	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:32.632471085 CEST	49862	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:32.755286932 CEST	6051	49862	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:32.756580114 CEST	49862	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:32.909164906 CEST	6051	49862	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:32.909343004 CEST	49862	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:33.015366077 CEST	6051	49862	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:33.022247076 CEST	49862	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:33.190275908 CEST	6051	49862	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:33.190433025 CEST	49862	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:33.348068953 CEST	6051	49862	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:33.348210096 CEST	49862	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:33.504400969 CEST	6051	49862	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:33.508982897 CEST	49862	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:33.614121914 CEST	6051	49862	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:33.615400076 CEST	49862	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:33.718867064 CEST	6051	49862	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:33.719188929 CEST	49862	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:33.877522945 CEST	6051	49862	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:33.883563995 CEST	49862	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:33.987179995 CEST	6051	49862	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:33.987298965 CEST	49862	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:34.089340925 CEST	6051	49862	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:34.093538046 CEST	49862	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:34.251873016 CEST	6051	49862	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:37.737878084 CEST	6051	49862	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:37.791677952 CEST	49862	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:38.591357946 CEST	6051	49862	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:38.657345057 CEST	49862	6051	192.168.2.4	23.146.242.147
Oct 26, 2021 12:09:42.765578032 CEST	6051	49862	23.146.242.147	192.168.2.4
Oct 26, 2021 12:09:42.818321943 CEST	49862	6051	192.168.2.4	23.146.242.147

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2021 12:07:41.512943029 CEST	49257	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:07:41.531513929 CEST	53	49257	8.8.8.8	192.168.2.4
Oct 26, 2021 12:07:41.693167925 CEST	62389	53	192.168.2.4	8.8.4.4
Oct 26, 2021 12:07:41.711807013 CEST	53	62389	8.8.4.4	192.168.2.4
Oct 26, 2021 12:07:41.741597891 CEST	49910	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:07:41.760184050 CEST	53	49910	8.8.8.8	192.168.2.4
Oct 26, 2021 12:07:45.845683098 CEST	55854	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:07:45.864526987 CEST	53	55854	8.8.8.8	192.168.2.4
Oct 26, 2021 12:07:45.932966948 CEST	64549	53	192.168.2.4	8.8.4.4
Oct 26, 2021 12:07:45.951548100 CEST	53	64549	8.8.4.4	192.168.2.4
Oct 26, 2021 12:07:45.958858013 CEST	63153	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:07:45.976881027 CEST	53	63153	8.8.8.8	192.168.2.4
Oct 26, 2021 12:07:50.216686964 CEST	52991	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:07:50.235449076 CEST	53	52991	8.8.8.8	192.168.2.4
Oct 26, 2021 12:07:50.239002943 CEST	53700	53	192.168.2.4	8.8.4.4
Oct 26, 2021 12:07:50.257596970 CEST	53	53700	8.8.4.4	192.168.2.4
Oct 26, 2021 12:07:50.266953945 CEST	51726	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:07:50.285274029 CEST	53	51726	8.8.8.8	192.168.2.4
Oct 26, 2021 12:07:54.330153942 CEST	56794	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:07:54.351468086 CEST	53	56794	8.8.8.8	192.168.2.4
Oct 26, 2021 12:08:00.544697046 CEST	56627	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:08:00.565524101 CEST	53	56627	8.8.8.8	192.168.2.4
Oct 26, 2021 12:08:08.555134058 CEST	56621	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:08:08.573555946 CEST	53	56621	8.8.8.8	192.168.2.4
Oct 26, 2021 12:08:14.900113106 CEST	63116	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:08:14.916676998 CEST	53	63116	8.8.8.8	192.168.2.4
Oct 26, 2021 12:08:21.499331951 CEST	64801	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:08:21.515520096 CEST	53	64801	8.8.8.8	192.168.2.4
Oct 26, 2021 12:08:29.199875116 CEST	51255	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:08:29.218661070 CEST	53	51255	8.8.8.8	192.168.2.4
Oct 26, 2021 12:08:36.523969889 CEST	60579	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:08:36.540235043 CEST	53	60579	8.8.8.8	192.168.2.4
Oct 26, 2021 12:08:43.741024971 CEST	61531	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:08:43.761434078 CEST	53	61531	8.8.8.8	192.168.2.4
Oct 26, 2021 12:08:49.903099060 CEST	49228	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:08:49.921401024 CEST	53	49228	8.8.8.8	192.168.2.4
Oct 26, 2021 12:08:55.849997044 CEST	59794	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:08:55.868859053 CEST	53	59794	8.8.8.8	192.168.2.4
Oct 26, 2021 12:09:02.073508024 CEST	55916	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:09:02.092452049 CEST	53	55916	8.8.8.8	192.168.2.4
Oct 26, 2021 12:09:08.520137072 CEST	52752	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:09:08.541229010 CEST	53	52752	8.8.8.8	192.168.2.4
Oct 26, 2021 12:09:14.489131927 CEST	60542	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:09:14.509752989 CEST	53	60542	8.8.8.8	192.168.2.4
Oct 26, 2021 12:09:20.514698029 CEST	64206	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:09:20.533269882 CEST	53	64206	8.8.8.8	192.168.2.4
Oct 26, 2021 12:09:26.475930929 CEST	50904	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:09:26.494824886 CEST	53	50904	8.8.8.8	192.168.2.4
Oct 26, 2021 12:09:32.497100115 CEST	57525	53	192.168.2.4	8.8.8.8
Oct 26, 2021 12:09:32.521940947 CEST	53	57525	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 26, 2021 12:07:41.512943029 CEST	192.168.2.4	8.8.8.8	0x3b6a	Standard query (0)	harold.accesscam.org	A (IP address)	IN (0x0001)
Oct 26, 2021 12:07:41.693167925 CEST	192.168.2.4	8.8.4.4	0x714a	Standard query (0)	harold.accesscam.org	A (IP address)	IN (0x0001)
Oct 26, 2021 12:07:41.741597891 CEST	192.168.2.4	8.8.8.8	0x965e	Standard query (0)	harold.accesscam.org	A (IP address)	IN (0x0001)
Oct 26, 2021 12:07:45.845683098 CEST	192.168.2.4	8.8.8.8	0x659f	Standard query (0)	harold.accesscam.org	A (IP address)	IN (0x0001)
Oct 26, 2021 12:07:45.932966948 CEST	192.168.2.4	8.8.4.4	0x2815	Standard query (0)	harold.accesscam.org	A (IP address)	IN (0x0001)
Oct 26, 2021 12:07:45.958858013 CEST	192.168.2.4	8.8.8.8	0xf936	Standard query (0)	harold.accesscam.org	A (IP address)	IN (0x0001)
Oct 26, 2021 12:07:50.216686964 CEST	192.168.2.4	8.8.8.8	0x2905	Standard query (0)	harold.accesscam.org	A (IP address)	IN (0x0001)
Oct 26, 2021 12:07:50.239002943 CEST	192.168.2.4	8.8.4.4	0x50cc	Standard query (0)	harold.accesscam.org	A (IP address)	IN (0x0001)
Oct 26, 2021 12:07:50.266953945 CEST	192.168.2.4	8.8.8.8	0xb3ec	Standard query (0)	harold.accesscam.org	A (IP address)	IN (0x0001)
Oct 26, 2021 12:07:54.330153942 CEST	192.168.2.4	8.8.8.8	0xab78	Standard query (0)	harold.2waky.com	A (IP address)	IN (0x0001)
Oct 26, 2021 12:08:00.544697046 CEST	192.168.2.4	8.8.8.8	0x2f90	Standard query (0)	harold.2waky.com	A (IP address)	IN (0x0001)
Oct 26, 2021 12:08:08.555134058 CEST	192.168.2.4	8.8.8.8	0x70bf	Standard query (0)	harold.2waky.com	A (IP address)	IN (0x0001)
Oct 26, 2021 12:08:14.900113106 CEST	192.168.2.4	8.8.8.8	0x4e1a	Standard query (0)	harold.2waky.com	A (IP address)	IN (0x0001)
Oct 26, 2021 12:08:21.499331951 CEST	192.168.2.4	8.8.8.8	0x2154	Standard query (0)	harold.2waky.com	A (IP address)	IN (0x0001)
Oct 26, 2021 12:08:29.199875116 CEST	192.168.2.4	8.8.8.8	0x59b0	Standard query (0)	harold.2waky.com	A (IP address)	IN (0x0001)
Oct 26, 2021 12:08:36.523969889 CEST	192.168.2.4	8.8.8.8	0x696	Standard query (0)	harold.2waky.com	A (IP address)	IN (0x0001)
Oct 26, 2021 12:08:43.741024971 CEST	192.168.2.4	8.8.8.8	0x971f	Standard query (0)	harold.2waky.com	A (IP address)	IN (0x0001)
Oct 26, 2021 12:08:49.903099060 CEST	192.168.2.4	8.8.8.8	0x3abc	Standard query (0)	harold.2waky.com	A (IP address)	IN (0x0001)
Oct 26, 2021 12:08:55.849997044 CEST	192.168.2.4	8.8.8.8	0x31e	Standard query (0)	harold.2waky.com	A (IP address)	IN (0x0001)
Oct 26, 2021 12:09:02.073508024 CEST	192.168.2.4	8.8.8.8	0xc552	Standard query (0)	harold.2waky.com	A (IP address)	IN (0x0001)
Oct 26, 2021 12:09:08.520137072 CEST	192.168.2.4	8.8.8.8	0x383d	Standard query (0)	harold.2waky.com	A (IP address)	IN (0x0001)
Oct 26, 2021 12:09:14.489131927 CEST	192.168.2.4	8.8.8.8	0x711	Standard query (0)	harold.2waky.com	A (IP address)	IN (0x0001)
Oct 26, 2021 12:09:20.514698029 CEST	192.168.2.4	8.8.8.8	0x11a0	Standard query (0)	harold.2waky.com	A (IP address)	IN (0x0001)
Oct 26, 2021 12:09:26.475930929 CEST	192.168.2.4	8.8.8.8	0xe1df	Standard query (0)	harold.2waky.com	A (IP address)	IN (0x0001)
Oct 26, 2021 12:09:32.497100115 CEST	192.168.2.4	8.8.8.8	0x6e77	Standard query (0)	harold.2waky.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 26, 2021 12:07:41.531513929 CEST	8.8.8.8	192.168.2.4	0x3b6a	Name error (3)	harold.accesscam.org	none	none	A (IP address)	IN (0x0001)
Oct 26, 2021 12:07:41.711807013 CEST	8.8.4.4	192.168.2.4	0x714a	Name error (3)	harold.accesscam.org	none	none	A (IP address)	IN (0x0001)
Oct 26, 2021 12:07:41.760184050 CEST	8.8.8.8	192.168.2.4	0x965e	Name error (3)	harold.accesscam.org	none	none	A (IP address)	IN (0x0001)
Oct 26, 2021 12:07:45.864526987 CEST	8.8.8.8	192.168.2.4	0x659f	Name error (3)	harold.accesscam.org	none	none	A (IP address)	IN (0x0001)
Oct 26, 2021 12:07:45.951548100 CEST	8.8.4.4	192.168.2.4	0x2815	Name error (3)	harold.accesscam.org	none	none	A (IP address)	IN (0x0001)
Oct 26, 2021 12:07:45.976881027 CEST	8.8.8.8	192.168.2.4	0xf936	Name error (3)	harold.accesscam.org	none	none	A (IP address)	IN (0x0001)
Oct 26, 2021 12:07:50.235449076 CEST	8.8.8.8	192.168.2.4	0x2905	Name error (3)	harold.accesscam.org	none	none	A (IP address)	IN (0x0001)
Oct 26, 2021 12:07:50.257596970 CEST	8.8.4.4	192.168.2.4	0x50cc	Name error (3)	harold.accesscam.org	none	none	A (IP address)	IN (0x0001)
Oct 26, 2021 12:07:50.285274029 CEST	8.8.8.8	192.168.2.4	0xb3ec	Name error (3)	harold.accesscam.org	none	none	A (IP address)	IN (0x0001)
Oct 26, 2021 12:07:54.351468086 CEST	8.8.8.8	192.168.2.4	0xab78	No error (0)	harold.2waky.com		23.146.242.147	A (IP address)	IN (0x0001)
Oct 26, 2021 12:08:00.565524101 CEST	8.8.8.8	192.168.2.4	0x2f90	No error (0)	harold.2waky.com		23.146.242.147	A (IP address)	IN (0x0001)
Oct 26, 2021 12:08:08.573555946 CEST	8.8.8.8	192.168.2.4	0x70bf	No error (0)	harold.2waky.com		23.146.242.147	A (IP address)	IN (0x0001)
Oct 26, 2021 12:08:14.916676998 CEST	8.8.8.8	192.168.2.4	0x4e1a	No error (0)	harold.2waky.com		23.146.242.147	A (IP address)	IN (0x0001)
Oct 26, 2021 12:08:21.515520096 CEST	8.8.8.8	192.168.2.4	0x2154	No error (0)	harold.2waky.com		23.146.242.147	A (IP address)	IN (0x0001)
Oct 26, 2021 12:08:29.218661070 CEST	8.8.8.8	192.168.2.4	0x59b0	No error (0)	harold.2waky.com		23.146.242.147	A (IP address)	IN (0x0001)
Oct 26, 2021 12:08:36.540235043 CEST	8.8.8.8	192.168.2.4	0x696	No error (0)	harold.2waky.com		23.146.242.147	A (IP address)	IN (0x0001)
Oct 26, 2021 12:08:43.761434078 CEST	8.8.8.8	192.168.2.4	0x971f	No error (0)	harold.2waky.com		23.146.242.147	A (IP address)	IN (0x0001)
Oct 26, 2021 12:08:49.921401024 CEST	8.8.8.8	192.168.2.4	0x3abc	No error (0)	harold.2waky.com		23.146.242.147	A (IP address)	IN (0x0001)
Oct 26, 2021 12:08:55.868859053 CEST	8.8.8.8	192.168.2.4	0x31e	No error (0)	harold.2waky.com		23.146.242.147	A (IP address)	IN (0x0001)
Oct 26, 2021 12:09:02.092452049 CEST	8.8.8.8	192.168.2.4	0xc552	No error (0)	harold.2waky.com		23.146.242.147	A (IP address)	IN (0x0001)
Oct 26, 2021 12:09:08.541229010 CEST	8.8.8.8	192.168.2.4	0x383d	No error (0)	harold.2waky.com		23.146.242.147	A (IP address)	IN (0x0001)
Oct 26, 2021 12:09:14.509752989 CEST	8.8.8.8	192.168.2.4	0x711	No error (0)	harold.2waky.com		23.146.242.147	A (IP address)	IN (0x0001)
Oct 26, 2021 12:09:20.533269882 CEST	8.8.8.8	192.168.2.4	0x11a0	No error (0)	harold.2waky.com		23.146.242.147	A (IP address)	IN (0x0001)
Oct 26, 2021 12:09:26.494824886 CEST	8.8.8.8	192.168.2.4	0xe1df	No error (0)	harold.2waky.com		23.146.242.147	A (IP address)	IN (0x0001)
Oct 26, 2021 12:09:32.521940947 CEST	8.8.8.8	192.168.2.4	0x6e77	No error (0)	harold.2waky.com		23.146.242.147	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Payment Notification.pdf.exe PID: 6132 Parent PID: 6520

General

Start time:	12:07:30
Start date:	26/10/2021
Path:	C:\Users\user\Desktop\Payment Notification.pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Payment Notification.pdf.exe'
Imagebase:	0x960000
File size:	457728 bytes
MD5 hash:	06E79CB697E436C1E66C49D3C39DBD82
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.681190398.0000000003001000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.681509296.0000000004001000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.681509296.0000000004001000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.681509296.0000000004001000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 3740 Parent PID: 6132

General

Start time:	12:07:37
Start date:	26/10/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XDyfQvRGNV' /XML 'C:\Users\user\AppData\Local\Temp\tmpB5A6.tmp'
Imagebase:	0x1390000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4720 Parent PID: 3740

General

Start time:	12:07:38
Start date:	26/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: RegSvcs.exe PID: 5412 Parent PID: 6132

General

Start time:	12:07:38
Start date:	26/10/2021
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
Imagebase:	0xa10000
File size:	32768 bytes
MD5 hash:	71369277D09DA0830C8C59F9E22BB23A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Payment Notification.pdf.exe PID: 6132 Parent PID: 6520 Payment Notification.pdf.exeCOMMON

Executed Functions

Function 0140BBDF, Relevance: 2.6, Strings: 2, Instructions: 60COMMON

Download Yara Rule

Strings

&, xrefs: 0140BBF9
!, xrefs: 0140BC90

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: !$&
API String ID: 0-3844837790
Opcode ID: 98f619a1c18a10165131a6a188db8f9c3eb91f17c8a06dc85d4ad67c6d8e86a3
Instruction ID: 8c2857ac9f6dd0987c27c0947b5dd9db374ff997ce0ba0be692c6f1cd19ce74e
Opcode Fuzzy Hash: 98f619a1c18a10165131a6a188db8f9c3eb91f17c8a06dc85d4ad67c6d8e86a3
Instruction Fuzzy Hash: 1F21E235D00229CFCB65DFA9D884BECB7B1EB09314F1080EAD519A72A1CB315AD5DF45

Uniqueness

Uniqueness Score: -1.00%

Function 01400138, Relevance: 2.0, Strings: 1, Instructions: 788COMMON

Download Yara Rule

Strings

$4Sp, xrefs: 01400233

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: $4Sp
API String ID: 0-3974485394
Opcode ID: 3a771e717659ea0e10ad623a1c42840e2f8bb207e5829526280cb6aeff11ac5d
Instruction ID: 5f2869a86339e78c9681c016774458280467b3da646925313866154926973f8e
Opcode Fuzzy Hash: 3a771e717659ea0e10ad623a1c42840e2f8bb207e5829526280cb6aeff11ac5d
Instruction Fuzzy Hash: A882D234A01218DFEB64DB64C884BDDB7B2BF89305F5185E9E409AB360CB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0140012A, Relevance: 2.0, Strings: 1, Instructions: 736COMMON

Download Yara Rule

Strings

$4Sp, xrefs: 01400233

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: $4Sp
API String ID: 0-3974485394
Opcode ID: 51ae80c796dfd8198ee0630df215ba039e79c04fd1c6453ccebace975f5ec54c
Instruction ID: 48efff801f1a2d5c81fea8681bb02f26c064f29411d1d5bcebaafd91e7de0fa0
Opcode Fuzzy Hash: 51ae80c796dfd8198ee0630df215ba039e79c04fd1c6453ccebace975f5ec54c
Instruction Fuzzy Hash: 8372D334A01218DFEB64DB64C894BDDB7B2BF89304F5585E9E409AB360CB35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 011CA2F6, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,00000E2C,?,?), ref: 011CA346

Memory Dump Source

Source File: 00000000.00000002.680860493.00000000011CA000.00000040.00000001.sdmp, Offset: 011CA000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 35379bc30d6f765313de7ad391f2d1a9c9d0a97054b061310c3212513d2dc773
Instruction ID: 66d1da781aa9d0fdaf10be4ed3c5f1c6e9916ae90706514a6f9d3bfb10148b23
Opcode Fuzzy Hash: 35379bc30d6f765313de7ad391f2d1a9c9d0a97054b061310c3212513d2dc773
Instruction Fuzzy Hash: D301A271500600ABD214DF1ADC82B26FBA8FB89B20F14815AED084BB41D271F516CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 01401A20, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1eddad347313e21f0c40cd9ca57f1a3ed6ca9eb9ed10820fff77d9560c706f4
Instruction ID: 6df8c5cab6233e494672370117b7af6fb7bb140b0e9002b71c357ba0867d109b
Opcode Fuzzy Hash: b1eddad347313e21f0c40cd9ca57f1a3ed6ca9eb9ed10820fff77d9560c706f4
Instruction Fuzzy Hash: 5E91C770D08219CFDF15CFAAC884BEEBBB2BF49704F10916AD409A7295DB749986CF40

Uniqueness

Uniqueness Score: -1.00%

Function 01401EE8, Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74505bff696e211d3370eaaa5d938fe680bd1684a0a9a009a8dbed7aa1b1283b
Instruction ID: cc8bd971234599e40ec8374817e5bb031de7aa19a6dd3a36f89cfb4e8a23ecd4
Opcode Fuzzy Hash: 74505bff696e211d3370eaaa5d938fe680bd1684a0a9a009a8dbed7aa1b1283b
Instruction Fuzzy Hash: 2B81F4B4D00219CFDB16DFAAC888AAEFBF2BF48300F14852AD505AB395D7749981CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01401A0F, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf6137f1fa4f871881e677f2ae4c0118dabf373a1306f6dcbff16b6b6e4401a9
Instruction ID: 9dd5275667c614be61815e93e5f37b3f86586e9877a6dce3623d8af04db737b9
Opcode Fuzzy Hash: cf6137f1fa4f871881e677f2ae4c0118dabf373a1306f6dcbff16b6b6e4401a9
Instruction Fuzzy Hash: 4081C674D04219CFDB15CFAAC884BEEBBF2BF89704F10816AD519A7291DB348986CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0140B437, Relevance: 7.7, Strings: 6, Instructions: 158COMMON

Download Yara Rule

Strings

', xrefs: 0140B8F4
+, xrefs: 0140B455
(, xrefs: 0140BB31
, xrefs: 0140BA5D
(, xrefs: 0140B966
$, xrefs: 0140B27B

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: $$$'$($($+
API String ID: 0-708850098
Opcode ID: 0e3bcf2546e9087819e477f3ff1e29da7de49da52419fae518b996da925b36a4
Instruction ID: 30cfeb019a13fa8ef33acbc2bbb19c442fd44b6b61924caf289ad5b2a78ef7c6
Opcode Fuzzy Hash: 0e3bcf2546e9087819e477f3ff1e29da7de49da52419fae518b996da925b36a4
Instruction Fuzzy Hash: 7D818A7490022CCFDB65DF6AC8887DDBBB1EB49305F1085EAC409A72A4DB345AC5DF85

Uniqueness

Uniqueness Score: -1.00%

Function 0140AE58, Relevance: 2.7, Strings: 2, Instructions: 171COMMON

Download Yara Rule

Strings

$, xrefs: 0140B27B
#, xrefs: 0140B20E

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: #$$
API String ID: 0-144778460
Opcode ID: 20f506e9b57bf8aa3977b100386ed30d1d9a245405a74695945a48a715f60c99
Instruction ID: cfd8258eda01ac69a192a5e93124f7b5d31f5ccead7f2773247fbbe4482dd56c
Opcode Fuzzy Hash: 20f506e9b57bf8aa3977b100386ed30d1d9a245405a74695945a48a715f60c99
Instruction Fuzzy Hash: 737118B4D0022D8FDB65CF66C844BEDBBB1AF49300F1081EAC519A72A0DB745AC5DF45

Uniqueness

Uniqueness Score: -1.00%

Function 01409492, Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

!, xrefs: 0140973F
, xrefs: 014097DB

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: $!
API String ID: 0-2056089098
Opcode ID: 4920f47a62f9ca78e0d1afd5767b407bb3d84e36e4fe8dfbe517719930266487
Instruction ID: 8567add261b2211fad9461ce19b74eed1c3af5e95b5bf56197c9b9d64931011f
Opcode Fuzzy Hash: 4920f47a62f9ca78e0d1afd5767b407bb3d84e36e4fe8dfbe517719930266487
Instruction Fuzzy Hash: 0C41FA75C19218DFDB29CFA6D4887EEBBB1FB49309F10946AD419A33A6C7344A85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0140B6C2, Relevance: 2.6, Strings: 2, Instructions: 72COMMON

Download Yara Rule

Strings

), xrefs: 0140B7B4
(, xrefs: 0140B966

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: ($)
API String ID: 0-2051389312
Opcode ID: 2cccebf125d59d08ae39b34b0288955a654c05a663f6a1ac0d94cb431758f724
Instruction ID: 976f3749e9ea22e99afee76f3c450e7254e879e88c92f9f828cc66d2a98934aa
Opcode Fuzzy Hash: 2cccebf125d59d08ae39b34b0288955a654c05a663f6a1ac0d94cb431758f724
Instruction Fuzzy Hash: 1031D17490026C8FDB69DF69C8887EDB7B2BB49305F1484AAD509AB290CB745A84CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0140B884, Relevance: 2.6, Strings: 2, Instructions: 51COMMON

Download Yara Rule

Strings

', xrefs: 0140B8F4
(, xrefs: 0140B966

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: '$(
API String ID: 0-102678571
Opcode ID: af02394b2fe971a048bf9e3995cf7db7739a4268bf6b14b2cc2e5620f97b5aea
Instruction ID: de8be4c6dc1bccba69b93bf952a676beb83f5498b3f2b7d1d3af4c39bf0e9aef
Opcode Fuzzy Hash: af02394b2fe971a048bf9e3995cf7db7739a4268bf6b14b2cc2e5620f97b5aea
Instruction Fuzzy Hash: D0218374E0122D8BDB65DF6AC8847D9B7B1FB49304F1085EAC509A7290DB309EC4DF85

Uniqueness

Uniqueness Score: -1.00%

Function 070B0DB6, Relevance: 1.6, APIs: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 070B0EC5

Memory Dump Source

Source File: 00000000.00000002.684707259.00000000070B0000.00000040.00000001.sdmp, Offset: 070B0000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d11e437d4f386893cc3d981c9053963fb9b04f75f4fb905408c3135fb4219bb3
Instruction ID: aad998a3d583e1673bb5fdf53cc0b1b810f71a7422f3b732c32c91ee490869d2
Opcode Fuzzy Hash: d11e437d4f386893cc3d981c9053963fb9b04f75f4fb905408c3135fb4219bb3
Instruction Fuzzy Hash: 5B517CB25093C09FE7238B758C54A92BFB4AF07314F0985DBE9C49F1A3D265A909C772

Uniqueness

Uniqueness Score: -1.00%

Function 070B0A02, Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(?,00000E2C,3418D452,00000000,00000000,00000000,00000000), ref: 070B0AAC

Memory Dump Source

Source File: 00000000.00000002.684707259.00000000070B0000.00000040.00000001.sdmp, Offset: 070B0000, based on PE: false

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 6ed549201ebd1373c1e66a33597bb17aa1a4318924ab7000962e48dd823fc81b
Instruction ID: 70ca6f9c62e286d226fc6af0bed41e6ff087dcc3727022411f64761fddfe93f2
Opcode Fuzzy Hash: 6ed549201ebd1373c1e66a33597bb17aa1a4318924ab7000962e48dd823fc81b
Instruction Fuzzy Hash: AB3195B1505781AFEB228F25DC45F97BFB8EF06310F0884ABE9859B153D264A908CB71

Uniqueness

Uniqueness Score: -1.00%

Function 011CAC22, Relevance: 1.6, APIs: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E2C), ref: 011CACD1

Memory Dump Source

Source File: 00000000.00000002.680860493.00000000011CA000.00000040.00000001.sdmp, Offset: 011CA000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: cb2116216e433be757d725f4c4570c89b3accb223b40daa10f46974fe378a920
Instruction ID: 7da58c5e814a8ee83f37d10b6ab93d75daa457f90b54e5f75f1a7c1e012bcac6
Opcode Fuzzy Hash: cb2116216e433be757d725f4c4570c89b3accb223b40daa10f46974fe378a920
Instruction Fuzzy Hash: B331C4725447846FE7228F25DC85F67BFBCEF05710F0884AAED818B152D264E509CB71

Uniqueness

Uniqueness Score: -1.00%

Function 070B04BE, Relevance: 1.6, APIs: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 070B054A

Memory Dump Source

Source File: 00000000.00000002.684707259.00000000070B0000.00000040.00000001.sdmp, Offset: 070B0000, based on PE: false

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 09257c65920de1f788f85787a33347014a5de2c3ac4d4cd6ce1d7a5016d07b3d
Instruction ID: 458e2bb3db761dcab50173df932b38a06fc0b0a2bcc6a1d585881a9e32585228
Opcode Fuzzy Hash: 09257c65920de1f788f85787a33347014a5de2c3ac4d4cd6ce1d7a5016d07b3d
Instruction Fuzzy Hash: 55316EB150D3C15FD7538B249CA5692BFB8AF07210F0D85DBE885CB1A3D2259848C762

Uniqueness

Uniqueness Score: -1.00%

Function 011CAD19, Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,3418D452,00000000,00000000,00000000,00000000), ref: 011CADD4

Memory Dump Source

Source File: 00000000.00000002.680860493.00000000011CA000.00000040.00000001.sdmp, Offset: 011CA000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1f2ccb170ae8c8e8e7a9e4752e3bcd19d589e3af035a7154ded54ad2e313a52e
Instruction ID: d20637da1faf7922da55f63369455626156d6471fcdd11712ca4f2ec1df9bb82
Opcode Fuzzy Hash: 1f2ccb170ae8c8e8e7a9e4752e3bcd19d589e3af035a7154ded54ad2e313a52e
Instruction Fuzzy Hash: D93191725097846FE722CF25DC85FA6BFF8EF06710F08849AE9858B153D364E548CB61

Uniqueness

Uniqueness Score: -1.00%

Function 011CA2AC, Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,00000E2C,?,?), ref: 011CA346

Memory Dump Source

Source File: 00000000.00000002.680860493.00000000011CA000.00000040.00000001.sdmp, Offset: 011CA000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 727c7616871d0ba39fbf437784107457d7f653d89c55c5cde3d397817378deea
Instruction ID: d3ac78b588729448a32c31af323e70f51214f9102eab77e5b5dd164f8aa572a6
Opcode Fuzzy Hash: 727c7616871d0ba39fbf437784107457d7f653d89c55c5cde3d397817378deea
Instruction Fuzzy Hash: 6C31827140E7C16FD3138B259C55A21BFB4EF47610F0A40DFE884CB5A3D229A919C762

Uniqueness

Uniqueness Score: -1.00%

Function 070B0676, Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

LsaOpenPolicy.ADVAPI32(?,00000E2C), ref: 070B0713

Memory Dump Source

Source File: 00000000.00000002.684707259.00000000070B0000.00000040.00000001.sdmp, Offset: 070B0000, based on PE: false

Similarity

API ID: OpenPolicy
String ID:
API String ID: 2030686058-0
Opcode ID: e11d647eeee9e7911e2d5922ecc0a0cb77786b23fbd9f33afb9b37ee3b5e2281
Instruction ID: 8894536b975e83f0368222ec901ce83168775f1ae43da7f3101ded68258198cf
Opcode Fuzzy Hash: e11d647eeee9e7911e2d5922ecc0a0cb77786b23fbd9f33afb9b37ee3b5e2281
Instruction Fuzzy Hash: 0C218DB2504344AFE722CF25DC85FA6FBE8EF05310F0885AAED849B152D264A909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 070B0F1C, Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,3418D452,00000000,00000000,00000000,00000000), ref: 070B0FB1

Memory Dump Source

Source File: 00000000.00000002.684707259.00000000070B0000.00000040.00000001.sdmp, Offset: 070B0000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 73e792ebc600b6d6973933adf381326e4c06452f5b59d34ba4b852744ca2ef3e
Instruction ID: 5a510ca195a917409178150968c2ba4be911c7e44b598223569e89fbabcae312
Opcode Fuzzy Hash: 73e792ebc600b6d6973933adf381326e4c06452f5b59d34ba4b852744ca2ef3e
Instruction Fuzzy Hash: D421F8B65087846FE712CB25DC80BA3BFB8EF46720F1885DAE9859B153D224A905CB71

Uniqueness

Uniqueness Score: -1.00%

Function 070B0E46, Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 070B0EC5

Memory Dump Source

Source File: 00000000.00000002.684707259.00000000070B0000.00000040.00000001.sdmp, Offset: 070B0000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5beb4a21d4a89a5725408f94f9fad6e62ab9b3b02bc7c949407a9c3454c67a45
Instruction ID: 6bf03aaceaf1d7210500265a04f56bba99254b84a6b3001a3623c71f7c98495a
Opcode Fuzzy Hash: 5beb4a21d4a89a5725408f94f9fad6e62ab9b3b02bc7c949407a9c3454c67a45
Instruction Fuzzy Hash: DE218CB1600744AFE731CF66CC84BA6FBE8EF08710F08856AE9858B652E375E504CB71

Uniqueness

Uniqueness Score: -1.00%

Function 070B0FEC, Relevance: 1.6, APIs: 1, Instructions: 75fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,3418D452,00000000,00000000,00000000,00000000), ref: 070B107D

Memory Dump Source

Source File: 00000000.00000002.684707259.00000000070B0000.00000040.00000001.sdmp, Offset: 070B0000, based on PE: false

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 1251bbc13be0070ba481a7baa67da9384d219df6e255757646e855e6ac7007f6
Instruction ID: 51b8a7939f3555b3fdc03045e21db886c3349f7fbf80e56fbf2ed73a5dde6b89
Opcode Fuzzy Hash: 1251bbc13be0070ba481a7baa67da9384d219df6e255757646e855e6ac7007f6
Instruction Fuzzy Hash: BE21A4B1409384AFD7228F65DC44F56BFB8EF06314F0885DBE9849F153C265A509CB72

Uniqueness

Uniqueness Score: -1.00%

Function 011CAC52, Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E2C), ref: 011CACD1

Memory Dump Source

Source File: 00000000.00000002.680860493.00000000011CA000.00000040.00000001.sdmp, Offset: 011CA000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 5e0cd2099b63f10e7f7ff477332d48631b3da679be68acc4be9b34feba198294
Instruction ID: 4113760a9717429cbdb8a9d9c8de3f5ffb4363fc3f432f25eea6047eaf2b9bf9
Opcode Fuzzy Hash: 5e0cd2099b63f10e7f7ff477332d48631b3da679be68acc4be9b34feba198294
Instruction Fuzzy Hash: 7E219272500704AFE7229F59DC84F6AFBECEF14720F04845AED419B641E764E509CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 070B06A2, Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

LsaOpenPolicy.ADVAPI32(?,00000E2C), ref: 070B0713

Memory Dump Source

Source File: 00000000.00000002.684707259.00000000070B0000.00000040.00000001.sdmp, Offset: 070B0000, based on PE: false

Similarity

API ID: OpenPolicy
String ID:
API String ID: 2030686058-0
Opcode ID: b8ad8fe1d0db55d3e120e7c6b3de31f8f22bf6e8720170d1d6a796ef64802787
Instruction ID: eb93a9517fcf5d8d9cda48ffdc0053daf8e2c89c0f0633060f93d66537a4fc9b
Opcode Fuzzy Hash: b8ad8fe1d0db55d3e120e7c6b3de31f8f22bf6e8720170d1d6a796ef64802787
Instruction Fuzzy Hash: 07219DB2900304AFEB21DE69DC85FAAFBE8EF04320F14896AED459A641D264E5058B71

Uniqueness

Uniqueness Score: -1.00%

Function 070B0A42, Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(?,00000E2C,3418D452,00000000,00000000,00000000,00000000), ref: 070B0AAC

Memory Dump Source

Source File: 00000000.00000002.684707259.00000000070B0000.00000040.00000001.sdmp, Offset: 070B0000, based on PE: false

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: c833becbe86bd681de45f0a738830eea95987f3b4ff9179999f694fd8873bcd4
Instruction ID: 821ed090fd08264297dc6cb4febac8149cd712a862c06b8153829588347a6ec8
Opcode Fuzzy Hash: c833becbe86bd681de45f0a738830eea95987f3b4ff9179999f694fd8873bcd4
Instruction Fuzzy Hash: 9D11ACB2500304AFEB218F69DC84FABFBA8EF04320F04886AE945DA641D674E504CB71

Uniqueness

Uniqueness Score: -1.00%

Function 011CAD5A, Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,3418D452,00000000,00000000,00000000,00000000), ref: 011CADD4

Memory Dump Source

Source File: 00000000.00000002.680860493.00000000011CA000.00000040.00000001.sdmp, Offset: 011CA000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 50344774bf784578d5debcadcf18315a6f05acfc288347bab47dd09d89fa9d4e
Instruction ID: 857d1be9e4235e42d61dc8bcc9ba482bfb5df462baf79d8cdffe09f401da4d18
Opcode Fuzzy Hash: 50344774bf784578d5debcadcf18315a6f05acfc288347bab47dd09d89fa9d4e
Instruction Fuzzy Hash: 0F219371600708AFE722CF29DC84FA6FBECEF14710F04846AED458B656E764E404CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 070B122B, Relevance: 1.6, APIs: 1, Instructions: 68fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 070B1298

Memory Dump Source

Source File: 00000000.00000002.684707259.00000000070B0000.00000040.00000001.sdmp, Offset: 070B0000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 5723c8fd2533c1eedc2a5130456c79f28d13fae0a6bf0520c5b9c8af7a349ba9
Instruction ID: f8a3419ee9ac5daa3f5a745c981d8267106653bbc1aa22a98ab919de32cb59f9
Opcode Fuzzy Hash: 5723c8fd2533c1eedc2a5130456c79f28d13fae0a6bf0520c5b9c8af7a349ba9
Instruction Fuzzy Hash: FE21A5B55093C49FD7528B25DC95B96BFB4DF02210F0980EBED85CF653D268A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 011CB42D, Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

LoadLibraryShim.MSCOREE(?,?,?,?), ref: 011CB4A9

Memory Dump Source

Source File: 00000000.00000002.680860493.00000000011CA000.00000040.00000001.sdmp, Offset: 011CA000, based on PE: false

Similarity

API ID: LibraryLoadShim
String ID:
API String ID: 1475914169-0
Opcode ID: 27d875fa5deee140e110704a24acb128dd759b91ee1a2bad058397ce3472bb95
Instruction ID: 1b0595cb62b73a93abe96539ce5bf6e1fdf509d929dcc40901c5ba3fd0e21f07
Opcode Fuzzy Hash: 27d875fa5deee140e110704a24acb128dd759b91ee1a2bad058397ce3472bb95
Instruction Fuzzy Hash: 49218EB15093805FD7228E29DC85B62FFE8EF16614F08809EED85CB253D365A808CB62

Uniqueness

Uniqueness Score: -1.00%

Function 070B137D, Relevance: 1.6, APIs: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 070B13F1

Memory Dump Source

Source File: 00000000.00000002.684707259.00000000070B0000.00000040.00000001.sdmp, Offset: 070B0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a2183b3418356a92a905f66ef831026303bbeb22f2a239dc439841d588879d1b
Instruction ID: c6495c0a853783fbc8da74dd999fd8b2c8eb8fc32d82dffbc5632e6c0b6176d2
Opcode Fuzzy Hash: a2183b3418356a92a905f66ef831026303bbeb22f2a239dc439841d588879d1b
Instruction Fuzzy Hash: 06219D724093C0AFDB238F25DC44A92FFB4EF07210F0985DBE9848F563D265A958DB62

Uniqueness

Uniqueness Score: -1.00%

Function 011CA5FB, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 011CA666

Memory Dump Source

Source File: 00000000.00000002.680860493.00000000011CA000.00000040.00000001.sdmp, Offset: 011CA000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d1add77039856bafe697e70c67212c65f114677ff068fa5b29e6671a66213ab1
Instruction ID: e0a229fc6fbfb83c9f8f091fe5e07a5fd531834d1751cbb369d51bd698304507
Opcode Fuzzy Hash: d1add77039856bafe697e70c67212c65f114677ff068fa5b29e6671a66213ab1
Instruction Fuzzy Hash: D2117F72409780AFDB238F65DC44A62FFF4EF4A610F0888DEED858B562D375A418DB61

Uniqueness

Uniqueness Score: -1.00%

Function 070B101E, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,3418D452,00000000,00000000,00000000,00000000), ref: 070B107D

Memory Dump Source

Source File: 00000000.00000002.684707259.00000000070B0000.00000040.00000001.sdmp, Offset: 070B0000, based on PE: false

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 740f6ae569f7b5c4c3d73b3a4f5274dba61d1b34938bd0a90ebcde13e0129dc6
Instruction ID: 88c2b2060c0dd900e094443a9e06d19b2a50d2b1dc41cd3eb351ce4eb1973672
Opcode Fuzzy Hash: 740f6ae569f7b5c4c3d73b3a4f5274dba61d1b34938bd0a90ebcde13e0129dc6
Instruction Fuzzy Hash: 7D11BFB2500344AFEB31CF55DC84BAAFBA8EF04320F14856AED459B646D274A504CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 070B05C5, Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 070B0627

Memory Dump Source

Source File: 00000000.00000002.684707259.00000000070B0000.00000040.00000001.sdmp, Offset: 070B0000, based on PE: false

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b257d177336db5eebf05b949269cd56af7cfd8938c277e3ad96504e2fab4d7e2
Instruction ID: cda7e4a82230bf8cfcd76f6bdf96db7280552a03e7b5c020e2fb399d414aef14
Opcode Fuzzy Hash: b257d177336db5eebf05b949269cd56af7cfd8938c277e3ad96504e2fab4d7e2
Instruction Fuzzy Hash: B211D3B65083849FD711CF25DC85B93BFE8EF45210F0884AAEC45CF252D275E944CB61

Uniqueness

Uniqueness Score: -1.00%

Function 070B170F, Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 070B1779

Memory Dump Source

Source File: 00000000.00000002.684707259.00000000070B0000.00000040.00000001.sdmp, Offset: 070B0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3237673330741a479f92af3ca4cd63c3225c1cf04039f7e03d5ee123d3fccc5a
Instruction ID: eaaf56e67a95e1365c6aba4d951f94bae0eee571a91bebb7ef0deeaa254c7966
Opcode Fuzzy Hash: 3237673330741a479f92af3ca4cd63c3225c1cf04039f7e03d5ee123d3fccc5a
Instruction Fuzzy Hash: 8D11BE724497849FDB228B15DC85B52FFB4EF06324F0884EEED858B563C265A918CB61

Uniqueness

Uniqueness Score: -1.00%

Function 011CA97B, Relevance: 1.6, APIs: 1, Instructions: 54comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 011CA9DC

Memory Dump Source

Source File: 00000000.00000002.680860493.00000000011CA000.00000040.00000001.sdmp, Offset: 011CA000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 9d8912f8319a79b0b01a535793fa0d6a3e9df764b7f6ca30166b0c6a81d0b638
Instruction ID: dfcaa9e5563e21d349216ee1ee8ddb0637567361e36605557f743e4e6ea29bef
Opcode Fuzzy Hash: 9d8912f8319a79b0b01a535793fa0d6a3e9df764b7f6ca30166b0c6a81d0b638
Instruction Fuzzy Hash: 73118F714493C4AFD7128F15DC85B52BFB4EF46224F0884EBED858F253D275A808CB62

Uniqueness

Uniqueness Score: -1.00%

Function 070B0502, Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 070B054A

Memory Dump Source

Source File: 00000000.00000002.684707259.00000000070B0000.00000040.00000001.sdmp, Offset: 070B0000, based on PE: false

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 044950c33d801348b48431fc9d1d1e0935acc5bd3d4b456e3baef3c6cf0fc6a0
Instruction ID: 725df1a09e7b842ed4c53e785ac256852a084acfdc4a57e1409208d14a778196
Opcode Fuzzy Hash: 044950c33d801348b48431fc9d1d1e0935acc5bd3d4b456e3baef3c6cf0fc6a0
Instruction Fuzzy Hash: 1C115EB16003019FDB60CF2AD885797FBE8EF04220F08C5AAED49CBA45E674E544CE71

Uniqueness

Uniqueness Score: -1.00%

Function 070B0F5E, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,3418D452,00000000,00000000,00000000,00000000), ref: 070B0FB1

Memory Dump Source

Source File: 00000000.00000002.684707259.00000000070B0000.00000040.00000001.sdmp, Offset: 070B0000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: d6dc27042c78e5643f618994c126dff2c42a233eef0d02826fb503c7126e9c84
Instruction ID: d93b13bcca5bddf39619a051a35a0c1f7123e95c64515acd7133409f585a0880
Opcode Fuzzy Hash: d6dc27042c78e5643f618994c126dff2c42a233eef0d02826fb503c7126e9c84
Instruction Fuzzy Hash: DE01C0B1600304AFE721CF15DC85BAAFBA8DF04720F54C1AAED459B646D278E504CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 070B05EA, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 070B0627

Memory Dump Source

Source File: 00000000.00000002.684707259.00000000070B0000.00000040.00000001.sdmp, Offset: 070B0000, based on PE: false

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9eb40b5535156eb9b3253b668c91190ac2ac263530f5a14cfd8ce1f1056c1423
Instruction ID: b0e077d8716ab0f40cc0c00d336d002f900e8446a06122f999a2645ed9787e49
Opcode Fuzzy Hash: 9eb40b5535156eb9b3253b668c91190ac2ac263530f5a14cfd8ce1f1056c1423
Instruction Fuzzy Hash: 270192B1A003459FDB60CF2AD884797FBD4EF48720F08C5AADD49CB656D275E504CE62

Uniqueness

Uniqueness Score: -1.00%

Function 011CAAEC, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 011CAB46

Memory Dump Source

Source File: 00000000.00000002.680860493.00000000011CA000.00000040.00000001.sdmp, Offset: 011CA000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 7d909c0599423c60d57c02538b9fe818c76152ce2068c6e15d9c9b3cafc554d9
Instruction ID: bf6fbb749041f14b38c76918a522620f1571e5640cacb59320d1155a1bfc549f
Opcode Fuzzy Hash: 7d909c0599423c60d57c02538b9fe818c76152ce2068c6e15d9c9b3cafc554d9
Instruction Fuzzy Hash: 68117C324097849FD7228F15DC85B52FFB4EF06620F08C4DAED858B662D375A818CB62

Uniqueness

Uniqueness Score: -1.00%

Function 070B125E, Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 070B1298

Memory Dump Source

Source File: 00000000.00000002.684707259.00000000070B0000.00000040.00000001.sdmp, Offset: 070B0000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: d62bf6a205c8b8e54acbee3a3f4dc9bd8c502165576be1544e7c0042fea6bae0
Instruction ID: abb2e1f633e3d5a8b949398751fa027c5af5cfe3f89e1da1531d2035fd698303
Opcode Fuzzy Hash: d62bf6a205c8b8e54acbee3a3f4dc9bd8c502165576be1544e7c0042fea6bae0
Instruction Fuzzy Hash: 42019EB1A00345CFDB60CF2AD8847A6FBD8EF01220F08C5BADC49CBA46D278E514CA61

Uniqueness

Uniqueness Score: -1.00%

Function 011CA42A, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 011CA480

Memory Dump Source

Source File: 00000000.00000002.680860493.00000000011CA000.00000040.00000001.sdmp, Offset: 011CA000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: bb62aa68ac645991708f1a4057d0b9dd0658a5afe435a1609ab387b52def3983
Instruction ID: 336315dfa85ec90a402095f57658f3cda2b3e04149df7b2de920d9328ad14b60
Opcode Fuzzy Hash: bb62aa68ac645991708f1a4057d0b9dd0658a5afe435a1609ab387b52def3983
Instruction Fuzzy Hash: 591161754093849FD7128B15DC99B52FFB4EF46720F0980DEED858F263D279A848CB62

Uniqueness

Uniqueness Score: -1.00%

Function 011CB45E, Relevance: 1.5, APIs: 1, Instructions: 46libraryCOMMON

Download Yara Rule

APIs

LoadLibraryShim.MSCOREE(?,?,?,?), ref: 011CB4A9

Memory Dump Source

Source File: 00000000.00000002.680860493.00000000011CA000.00000040.00000001.sdmp, Offset: 011CA000, based on PE: false

Similarity

API ID: LibraryLoadShim
String ID:
API String ID: 1475914169-0
Opcode ID: c34a80155e6c4f57d2ca18fc32eee44999d6b2e8299d771aaf6592b56ccc8d8e
Instruction ID: 3c952e740de5177c1032cedd55c14c279dc8d8d4dd2dd42f91659c392d9914e0
Opcode Fuzzy Hash: c34a80155e6c4f57d2ca18fc32eee44999d6b2e8299d771aaf6592b56ccc8d8e
Instruction Fuzzy Hash: D70184715087008FD724CE19D886B22FBE4EF14A60F08C49DDD46CB646D375E404CB72

Uniqueness

Uniqueness Score: -1.00%

Function 011CA622, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 011CA666

Memory Dump Source

Source File: 00000000.00000002.680860493.00000000011CA000.00000040.00000001.sdmp, Offset: 011CA000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1bdeee23eda840b4990351cd0b4a201f96772172374175c8d7adce737f4cdc8e
Instruction ID: 36f079f670f9e7f6cf758a10279955b43a38d1a14b7da0d6d854e34ff05f4e8c
Opcode Fuzzy Hash: 1bdeee23eda840b4990351cd0b4a201f96772172374175c8d7adce737f4cdc8e
Instruction Fuzzy Hash: D7015E715007449FDB228F55D944B56FFA4EF48720F08C8AEDD454B616E375A414CF62

Uniqueness

Uniqueness Score: -1.00%

Function 070B173E, Relevance: 1.5, APIs: 1, Instructions: 42windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 070B1779

Memory Dump Source

Source File: 00000000.00000002.684707259.00000000070B0000.00000040.00000001.sdmp, Offset: 070B0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 304e5f11a455f6a21d64cb4a7f807b0461ba88dea924438df0935053b52f0809
Instruction ID: 74446b46729328017b301ad417fc9d51bfb89c65f90033cd11f4efc8e4b41ba3
Opcode Fuzzy Hash: 304e5f11a455f6a21d64cb4a7f807b0461ba88dea924438df0935053b52f0809
Instruction Fuzzy Hash: F401B1756507048FDB20CF16D884B69FBE4EF04320F08C1AEDD454BA51D275E918CF62

Uniqueness

Uniqueness Score: -1.00%

Function 011CA9AA, Relevance: 1.5, APIs: 1, Instructions: 39comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 011CA9DC

Memory Dump Source

Source File: 00000000.00000002.680860493.00000000011CA000.00000040.00000001.sdmp, Offset: 011CA000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ce45b7ecfdae0882cbaec2533aa8dce2aa11ca3a7ec1021a87497c038cfdacc0
Instruction ID: 7a81fd4dbd59d5076e57a42c107a7df1e765e40189e8c88f81c96fa2b5dde4e1
Opcode Fuzzy Hash: ce45b7ecfdae0882cbaec2533aa8dce2aa11ca3a7ec1021a87497c038cfdacc0
Instruction Fuzzy Hash: DE018B759003449FDB61CF5AE9857A5FBA4EF04620F08C4AADD498F606E378A444CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 070B13B6, Relevance: 1.5, APIs: 1, Instructions: 38windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 070B13F1

Memory Dump Source

Source File: 00000000.00000002.684707259.00000000070B0000.00000040.00000001.sdmp, Offset: 070B0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: fde3f47ecabf51da82c08c7acdec21c51aa94ebca9630ef296db2dbda7a57d4a
Instruction ID: 2aa7a9c48ee97fce93400135239ea8cba58cef830f2074c1d8fc9d313d0b6c10
Opcode Fuzzy Hash: fde3f47ecabf51da82c08c7acdec21c51aa94ebca9630ef296db2dbda7a57d4a
Instruction Fuzzy Hash: 6E017C715007049FDB208F56D884B65FFA0EF08320F08C5AADE454BA16E3B9A558CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 011CAB0E, Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 011CAB46

Memory Dump Source

Source File: 00000000.00000002.680860493.00000000011CA000.00000040.00000001.sdmp, Offset: 011CA000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 63e6f3280e5fd17dc41b2f964fbe531c0adff83afe01f26a38603f9e4f971673
Instruction ID: 73accdcf17899cdb94e1dd99f273560eb15dfbea3b10fb47c055b6b70c56f38b
Opcode Fuzzy Hash: 63e6f3280e5fd17dc41b2f964fbe531c0adff83afe01f26a38603f9e4f971673
Instruction Fuzzy Hash: 5B01AD315007048FDB258F4AE884B11FFA0EF04B20F08C8AEDD464BA56E375A408CFB2

Uniqueness

Uniqueness Score: -1.00%

Function 011CA44E, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 011CA480

Memory Dump Source

Source File: 00000000.00000002.680860493.00000000011CA000.00000040.00000001.sdmp, Offset: 011CA000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 6b1f481c5f2ef0692956a6792e6f196d475d2911ef955433822ccef1bc69c6c5
Instruction ID: bda62ad8dc00ff27c45604841c7e77c7ccd71665a1409ac8518efd08b0a69854
Opcode Fuzzy Hash: 6b1f481c5f2ef0692956a6792e6f196d475d2911ef955433822ccef1bc69c6c5
Instruction Fuzzy Hash: E3F0A4355043488FD7258F0AE889761FFA4EF04720F0CC0AEDD454B656E379A404CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 0140A228, Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

:@fq, xrefs: 0140A2DC

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: :@fq
API String ID: 0-3673016210
Opcode ID: bf44ea6a657c80e2441011d8507a9019f25e723489038953abaa9a11e4526737
Instruction ID: 8af5bef5ba9163937fad3627a6dcfd3bf0a2a26d21677836615bb5a36ea256be
Opcode Fuzzy Hash: bf44ea6a657c80e2441011d8507a9019f25e723489038953abaa9a11e4526737
Instruction Fuzzy Hash: 0371C074D002198FDB15DFEAC948AADBBB2FF89304F20813AD419AB3A5DB355946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0140A238, Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

:@fq, xrefs: 0140A2DC

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: :@fq
API String ID: 0-3673016210
Opcode ID: a05c94e068d239ab39ae6bf397dfb55d2423221f46c2bac9dda47a86e660f463
Instruction ID: 25324645c6a8b487852f13aa600e351a1508c2a7973133fc43e5b1ddca9e7182
Opcode Fuzzy Hash: a05c94e068d239ab39ae6bf397dfb55d2423221f46c2bac9dda47a86e660f463
Instruction Fuzzy Hash: 7671B174D00219DFDB15DFEAC9486ADBBB2BF89304F20813AD519AB3A4DB345945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01409338, Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

!, xrefs: 0140973F

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 1b0a82124d0ca0132d6412e2f165e15cd7e5f1d28984cfac7fe29f14ff6debbc
Instruction ID: d4ea4cb84a2422a1d8b44fc255452e114524661566e1c6347a1b6e3d632d7658
Opcode Fuzzy Hash: 1b0a82124d0ca0132d6412e2f165e15cd7e5f1d28984cfac7fe29f14ff6debbc
Instruction Fuzzy Hash: 9B512B70C15208DFEB24CFA6D4487EEBBB1FB49308F10946AD019A73A2CB754A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 014096D1, Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

!, xrefs: 0140973F

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: e39a648872c31b220cd20b0721320b60be839755bf84dd88490b5d4153935b98
Instruction ID: 8a6138240355e8891fe97461d6c36c49084baf36f279bcada191cc57a97803c1
Opcode Fuzzy Hash: e39a648872c31b220cd20b0721320b60be839755bf84dd88490b5d4153935b98
Instruction Fuzzy Hash: 00510875C15218DFEB69CFA6D4487EDBBB0BB49309F10947AD019A33A2CB744A85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 01409328, Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

!, xrefs: 0140973F

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 1b20b6d5b7cdaf57a4d7af81f24c984b082a9720a1ab29e73bf848bcef240a73
Instruction ID: 92df700cccf14d1a6f6d913c4eafc144a75c675d99c651fa9cbab605a2f4a8ad
Opcode Fuzzy Hash: 1b20b6d5b7cdaf57a4d7af81f24c984b082a9720a1ab29e73bf848bcef240a73
Instruction Fuzzy Hash: 92512A70C15208DFEB25CFA6D4587EEBBB1FB49309F10946AD019A73A2C7794A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0140942D, Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

!, xrefs: 0140973F

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: a96a29f9face964f810b368878e8c227d588d6991a2714c5ab0a14044774f039
Instruction ID: 7e3e80ae92fb6600cbe61bd9e15d9725fdfbc1f8ce70f45ed39d12e72dcd8deb
Opcode Fuzzy Hash: a96a29f9face964f810b368878e8c227d588d6991a2714c5ab0a14044774f039
Instruction Fuzzy Hash: F351DB75C14218DFDB69CFA6D4887ADBBB1FB49309F10946AD019A73A2CB744985CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0140974D, Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

!, xrefs: 0140973F

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 2622387022a786d53caff4e657edae850de96381bd683d7035a7ceb312ecd58a
Instruction ID: e7c82e3d790d3dfb105d1ecd25f60c59e59cbf2b96e9e6098afb7c0cfd4328e5
Opcode Fuzzy Hash: 2622387022a786d53caff4e657edae850de96381bd683d7035a7ceb312ecd58a
Instruction Fuzzy Hash: 51414B71C19248DFDB25CFB6D448BADBBB0BB46318F1095ABD019A72E2CB344A85CF11

Uniqueness

Uniqueness Score: -1.00%

Function 014093D1, Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

!, xrefs: 0140973F

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 00f473caad9edc13666f691da1bd5e09523b8e4f1672aef8fa5682ecd116a1c2
Instruction ID: e8bb4ed2a078ef533bfa020144bad0c592420ef5424aad46a0de3393f511263b
Opcode Fuzzy Hash: 00f473caad9edc13666f691da1bd5e09523b8e4f1672aef8fa5682ecd116a1c2
Instruction Fuzzy Hash: 5A412971C19218CFDB65CFB5D448BADBBB1FB4A308F1095AAD419A73A2CB344985CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0140953C, Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

!, xrefs: 0140973F

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 37236dfee9dfa07bfb536cdf12c01a508fcd84dee8a51f6419756cb9c67788d6
Instruction ID: 7a8d687f7485f06656792ee02f736cff149c7cd5c0bd9deb60618eb10d0a47d8
Opcode Fuzzy Hash: 37236dfee9dfa07bfb536cdf12c01a508fcd84dee8a51f6419756cb9c67788d6
Instruction Fuzzy Hash: 36413E71C19208CFEB25CFB5D4487ADBBB1FB4A309F10946AD019A73A2CB344A85CF11

Uniqueness

Uniqueness Score: -1.00%

Function 01409786, Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

!, xrefs: 0140973F

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 427f99e97ffdb0046325fe5c39839eec946fd7749610827e9dd28225e722d01c
Instruction ID: 3c3c74a272f90fc8db23ec9700afc71c32e55341965a729857e48eef9fe8769c
Opcode Fuzzy Hash: 427f99e97ffdb0046325fe5c39839eec946fd7749610827e9dd28225e722d01c
Instruction Fuzzy Hash: F6410871C15208DFDB29DFB6D448BADBBB1FB49309F10946AD01AA33A6CB344A85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 014095B4, Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

!, xrefs: 0140973F

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 86f893a8268eaf59fdff31621718831417f0475256c4d6b2087e60f5b281f775
Instruction ID: 5c70d62fd672ec9ee36f9f789eb5a01670a6a1683183a8a25b995544d23a056a
Opcode Fuzzy Hash: 86f893a8268eaf59fdff31621718831417f0475256c4d6b2087e60f5b281f775
Instruction Fuzzy Hash: 7B412E71C19208DFDB65CFB5D488BADBBB1FB4A309F10946AD019A73A2CB744985CF11

Uniqueness

Uniqueness Score: -1.00%

Function 0140988C, Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

!, xrefs: 0140973F

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 768b7fa7a7b49ad128aed6826c48a71b2fe0262ae50e9c1ad19685dd78e92818
Instruction ID: 0e9ce8f69b70004ed0c638917295e151759ae6f138119b3975baf131835744ee
Opcode Fuzzy Hash: 768b7fa7a7b49ad128aed6826c48a71b2fe0262ae50e9c1ad19685dd78e92818
Instruction Fuzzy Hash: BD410D71C19208DFDB29CFA6D448BADB7B1FB49309F10946BD019A33A6CB344A85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 014095E7, Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

!, xrefs: 0140973F

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: b0958e59a4553192e7918b122b180efcf807317d97b73ef3a1e547c767384533
Instruction ID: 1d071b6c45632b4d327398231ed06b8470192b0e736edb8c636b0827277a66c1
Opcode Fuzzy Hash: b0958e59a4553192e7918b122b180efcf807317d97b73ef3a1e547c767384533
Instruction Fuzzy Hash: 56410C75C19208DFDB69CFA6D448BADBBB1FB49309F10946BD019A33A6CB344A85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 01409668, Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

!, xrefs: 0140973F

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: b09ccfcb29f2afbc2d066b6436d2450ad16e09ba9920da8b7fb9832386855a53
Instruction ID: a718ead6e079ac198a21d8b539f8013c675736d7fa339ba8115179dec35c45b8
Opcode Fuzzy Hash: b09ccfcb29f2afbc2d066b6436d2450ad16e09ba9920da8b7fb9832386855a53
Instruction Fuzzy Hash: 58411C70819218DFEB65CFB5D458BADBBB1FB4A309F1094AAD019A73A2CB744985CF10

Uniqueness

Uniqueness Score: -1.00%

Function 01409597, Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

!, xrefs: 0140973F

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 74b0575b47f1750a0c02dbb63f696f950f52f615711f23a83f5788561262b950
Instruction ID: 701734c34754352f3ae1b4f36fa23490d621464156d09fa66f8deb4174cdd464
Opcode Fuzzy Hash: 74b0575b47f1750a0c02dbb63f696f950f52f615711f23a83f5788561262b950
Instruction Fuzzy Hash: E3410B71819208DFDB25CFB5D448BADBBB1BB4A309F10946AD01DA73A6CB344985CF11

Uniqueness

Uniqueness Score: -1.00%

Function 01409642, Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

!, xrefs: 0140973F

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 7700636bf3ce4cf8a237a9a86f386646acacacf51c31efbbfc0e567d87d4b831
Instruction ID: eb4cb975f6cf461330edee557e433bafcf7dd9640317287bd68e2f8d656fde16
Opcode Fuzzy Hash: 7700636bf3ce4cf8a237a9a86f386646acacacf51c31efbbfc0e567d87d4b831
Instruction Fuzzy Hash: 1841F874C19218DFDB69CFB6D448BADBBB1FB49309F10946AD419A33A6CB344A85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0140957F, Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

!, xrefs: 0140973F

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 24dc498d910d2a911a01d75e8fae15a9f23f564189169c4975c59929199a729e
Instruction ID: 8ac036297fd4e59173a8c156d024dbd6a746120943cbd2e9dc849189c8cc4be6
Opcode Fuzzy Hash: 24dc498d910d2a911a01d75e8fae15a9f23f564189169c4975c59929199a729e
Instruction Fuzzy Hash: 9031F870D15208DFDB69CFB6D448BADBBB1FB49309F00946A9019A33A6CB344985CF10

Uniqueness

Uniqueness Score: -1.00%

Function 01409628, Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

!, xrefs: 0140973F

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 787868abe33dcab46f169705d02e00a85b5e545bd95288a48fab39900d28518d
Instruction ID: 272807cf15e1e37ffd2458be5bb3997be5191be791f122b903e76c4f03da4a9b
Opcode Fuzzy Hash: 787868abe33dcab46f169705d02e00a85b5e545bd95288a48fab39900d28518d
Instruction Fuzzy Hash: 0931E971D19208DFDB69CFB6D448BADBBB1FB49309F10946AD419A33A6CB344985CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0140952D, Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

!, xrefs: 0140973F

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 79785f9edd3522a27c8503f67f6633516e0e28538cc43c266ec66a94cae04427
Instruction ID: 9d2b5eb3793f6b4021590c9818febbe01f043ba7c32a43ce69015fdef36e3008
Opcode Fuzzy Hash: 79785f9edd3522a27c8503f67f6633516e0e28538cc43c266ec66a94cae04427
Instruction Fuzzy Hash: 4B311970C19208DFDB29CFA6D448BADBBB1FB49309F00946AD01DA33A2CB344A85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0140B975, Relevance: 1.3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

Strings

*, xrefs: 0140B9A6

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: *
API String ID: 0-163128923
Opcode ID: 4f12b1776d11c392c1ff582643aca3aea7f5c97a5d234a117b67b7070e68eafb
Instruction ID: 98d36072b48902ea57491bafe957aef5883771f3576647cf9cd4fee70b315ad1
Opcode Fuzzy Hash: 4f12b1776d11c392c1ff582643aca3aea7f5c97a5d234a117b67b7070e68eafb
Instruction Fuzzy Hash: 9EE01274E052188FEB24CFA1C850B9CBBF2FB48300F2080AA92086B290CA320A819F44

Uniqueness

Uniqueness Score: -1.00%

Function 01409D30, Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f7bba8c78b91e09ff233820b08a9ee8da3e0ea33076346edebeb8370fefe6a
Instruction ID: 9cfce7be8827b5501d1b09ff5e809309393b9fc76c9cc82291f7f641683076d4
Opcode Fuzzy Hash: 86f7bba8c78b91e09ff233820b08a9ee8da3e0ea33076346edebeb8370fefe6a
Instruction Fuzzy Hash: 98B10670E40218DBEB14DFE5D895B9DBBB2BF89B04F20902AD905BB394CBB15945CF44

Uniqueness

Uniqueness Score: -1.00%

Function 01408C74, Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ae0d074c1840562787f5aedb0e16149b0589fbd3cdcfe7b3158f8632cb61be
Instruction ID: 1dbc28ada31acf1b03edaa22ff6a7c4e236d61739ddf8352ca5b63029db96e9b
Opcode Fuzzy Hash: b1ae0d074c1840562787f5aedb0e16149b0589fbd3cdcfe7b3158f8632cb61be
Instruction Fuzzy Hash: 3C9159B4D05209CFCF02DFAACA846DDBBB1BF49325F25816AD415AB3A2D7749842CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0140AA38, Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6888016a2de47c401d4db973e117d6f81862f9c2c865b2a9c760b93852ad4fa1
Instruction ID: 686d16107303015d93863e296353eac73d90e40dc0f64d2f0e2494ac35aac96c
Opcode Fuzzy Hash: 6888016a2de47c401d4db973e117d6f81862f9c2c865b2a9c760b93852ad4fa1
Instruction Fuzzy Hash: 5091D474D05319CFDB11DFAAC5447AEBBF2BB48304F20846AD519AB2A0DB744A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0140AA28, Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ffabefedd548e11413d5ab76cc056f4a447a49145dc299dc3e689b8db00c6a
Instruction ID: f85d8e2aa7ad5862a9897b39c91f79af4c0a1c1374dc77642af40cb95d8f6eed
Opcode Fuzzy Hash: 72ffabefedd548e11413d5ab76cc056f4a447a49145dc299dc3e689b8db00c6a
Instruction Fuzzy Hash: B981D274D05319CFDB11DFAAC5447AEBBF2FB49304F20846AD419AB2A1DB780A86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 01401208, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e16afbdf458c011e818035273123d1bc2b87a10b9d82f65153884bee13ab84a1
Instruction ID: e08f98de3ba9ea3906b20345aff6fc86ee472b0cd94dd8c4fd54e2636cdb6abf
Opcode Fuzzy Hash: e16afbdf458c011e818035273123d1bc2b87a10b9d82f65153884bee13ab84a1
Instruction Fuzzy Hash: 6A7191B4D04218CFDB18DFE9E848AADBBF2BB49701F10953AD815AB3A4D7749981CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01401ED9, Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eb0dfe0e98dbe7a8e5e8e66b888650a917fa0cb5f572de144a209a3c89fd0f6
Instruction ID: 2784313f42d9c9c5e82844fba30d3d2d79506702f4da3b4931f1b4e012f5d500
Opcode Fuzzy Hash: 4eb0dfe0e98dbe7a8e5e8e66b888650a917fa0cb5f572de144a209a3c89fd0f6
Instruction Fuzzy Hash: 1D6105B4D04219CFDB16DFAAC848AEEFBF2BB49300F14852AD505AB3A5D7748945CF41

Uniqueness

Uniqueness Score: -1.00%

Function 014011F8, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f54abbba361d7f09d84f0855e910ba3276b5f7ae961eb2580be9f960d5777b23
Instruction ID: 8a7e49d1adfcd12713302c0dfc38551a13d0dc1b4f62f9dc3f085fd0f19d8d26
Opcode Fuzzy Hash: f54abbba361d7f09d84f0855e910ba3276b5f7ae961eb2580be9f960d5777b23
Instruction Fuzzy Hash: 0471C2B4D04218CFDB19DFE9E848AADBBF2BB49300F10857AD815AB3A4D7709981CF41

Uniqueness

Uniqueness Score: -1.00%

Function 01408F38, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cb5410d3db4176c4aff1f9913a67419748dcd8eb6b5099e2810d7de6f61e456
Instruction ID: c0b9034797bd886690ff5ce48d2a8ef7f3f005b0ba88b88a0f6ccba262cd0bb5
Opcode Fuzzy Hash: 3cb5410d3db4176c4aff1f9913a67419748dcd8eb6b5099e2810d7de6f61e456
Instruction Fuzzy Hash: AF515EB0D05209DFDB02DFAAC544AAEBBF2BF49318F14D16AD418B72A2D7748941CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0140AE48, Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 200821d08e1a67c0999680afbeef39ff1d63d58b9af7f6545ad82273b4396d35
Instruction ID: eb46e3b25d548d600b97bb2625c9098f8f237964ee22ea9dffda83cf6931e222
Opcode Fuzzy Hash: 200821d08e1a67c0999680afbeef39ff1d63d58b9af7f6545ad82273b4396d35
Instruction Fuzzy Hash: DA5128B4D402298FDB65CF6AC8447EDBBB1AF49300F1085BAD419A72A0DB745AC6DF41

Uniqueness

Uniqueness Score: -1.00%

Function 01408F28, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f8cb21cf4068f5e128d0b574f5a481554aabf4a1a5e77662897f6fa6dc77f18
Instruction ID: 9c67a25db9ec5bd7e4c0e30b004f50578ea8f6f0ec22f7979692f4d519c4b541
Opcode Fuzzy Hash: 9f8cb21cf4068f5e128d0b574f5a481554aabf4a1a5e77662897f6fa6dc77f18
Instruction Fuzzy Hash: 75414BB0D0920ADFDB02DFAAD644BEEBBF1AF55318F10D16AD408B32A2D7744A418B51

Uniqueness

Uniqueness Score: -1.00%

Function 01409A72, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249b0cf6749e2fd6ea8a7c78d92ba391b9036a08bf816cfddf355e60fabec85b
Instruction ID: 62a0a8a803e67e02eb77bcb33e14176182c096c4443cd7acfd81b2fb9a13e7b2
Opcode Fuzzy Hash: 249b0cf6749e2fd6ea8a7c78d92ba391b9036a08bf816cfddf355e60fabec85b
Instruction Fuzzy Hash: B6413570E04218CFCB15DFEAD4846EEBBB2BF89324F24942AD009BB2A5D7715885CF10

Uniqueness

Uniqueness Score: -1.00%

Function 01402277, Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77795ced23a258531a02fd7b58ea3d3748cb39c53b3ccff5138c5f505e52d599
Instruction ID: ee1ee848c2fbc24af749b7978044c032f341aba55768550f44703e571d1bc8b5
Opcode Fuzzy Hash: 77795ced23a258531a02fd7b58ea3d3748cb39c53b3ccff5138c5f505e52d599
Instruction Fuzzy Hash: 1E310A30B053968FD706DBF988546AE7FB5BF82610F2444ABD005DB2D5CEB44D06C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0140AF4D, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03a056b7a269ed9138afcd0109a70862a5239080d145b1eb315505ce71d1e6ea
Instruction ID: 3e8604edd8f9beea28dc798e9602565b15cb64a5ae84aa7390c5c3885382113a
Opcode Fuzzy Hash: 03a056b7a269ed9138afcd0109a70862a5239080d145b1eb315505ce71d1e6ea
Instruction Fuzzy Hash: C24122B4904229CFDB61CF65C884BEDBBB1AF09300F1080EAD119A72A1D7B85EC6DF55

Uniqueness

Uniqueness Score: -1.00%

Function 011EA6EC, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 590deb333ff1548913cfa3202f2dca4d3c564e1ad7013c57e1f0ad9129a12e85
Instruction ID: d38ec34e0643622bd3bdab512264f98b6647cf22398c8ea9d453e51d767efad8
Opcode Fuzzy Hash: 590deb333ff1548913cfa3202f2dca4d3c564e1ad7013c57e1f0ad9129a12e85
Instruction Fuzzy Hash: 0E316B76508340AFD310CF05EC41A56FFE8EB89630F18C96FF9499B611D236A904CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 011EA944, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169a5158f4511d08667bc11e41c6374d49f0531ec52e9748bc817ea4ddb9a256
Instruction ID: 2cad0315aaff0dbb5d2778efb6aad0b6ac3ad31a3af094dccb57619daa935fdd
Opcode Fuzzy Hash: 169a5158f4511d08667bc11e41c6374d49f0531ec52e9748bc817ea4ddb9a256
Instruction Fuzzy Hash: 0A314BB6548340AFD310CF09EC81A57FBE8EB89620F14C96EFD499B611D235E914CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 011EA81A, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f58ad6010477185c76ff3e72dc855544c416ae526d4f5514b6e9aa63280228b4
Instruction ID: 2e59388e6d9ad04437e2242762836a1bba9ed021a16bf46700ea1426f91d2186
Opcode Fuzzy Hash: f58ad6010477185c76ff3e72dc855544c416ae526d4f5514b6e9aa63280228b4
Instruction Fuzzy Hash: FB316976948340AFD310CF05EC81A56FFE8EB89620F18C96EFD4997611D236A904CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 011EA5C0, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bff18a8bbea49b1176b5a23c707cebde252f0724bd77605d5df275ee7e8c6896
Instruction ID: 3a2571c26e06f3e3c1139413b670c185ef84a17935aec7a579d63463046dca54
Opcode Fuzzy Hash: bff18a8bbea49b1176b5a23c707cebde252f0724bd77605d5df275ee7e8c6896
Instruction Fuzzy Hash: 5121D372544300AFD7118F05EC41956FFE8EB85630F18C56FFD499B612D236A914CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 011EA3AA, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee18bf0447b77bd2c5e4429eac5c4869d0097a496dfc67b78b87bb6e5153f7d2
Instruction ID: c67727e73f152a07ff5c343ade1ab655b5cdd44fbe4ac5e5259c418550493e59
Opcode Fuzzy Hash: ee18bf0447b77bd2c5e4429eac5c4869d0097a496dfc67b78b87bb6e5153f7d2
Instruction Fuzzy Hash: EF21FE72508340AFD3108F0AEC41E53FFE8EB85630F08C4AEFD095B211D276A904CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 011EAAC8, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa0a0eedbd274acd8e94cc618e8aa7c4d29e65664868eb3cdd38c3a82dbb6de2
Instruction ID: 16a5dd196014c5997abcc3d2075ba2696ffc684f581878d0e056fcace1e003ba
Opcode Fuzzy Hash: aa0a0eedbd274acd8e94cc618e8aa7c4d29e65664868eb3cdd38c3a82dbb6de2
Instruction Fuzzy Hash: 8A314CB550E3C19FD302CF259850A56BFF4EF8A614F0888DFE8C8DB252D2759948CB62

Uniqueness

Uniqueness Score: -1.00%

Function 011EA191, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbf103b6ad041aa013e52fc611b0184552ee62948ae99acf5f36f6584707a561
Instruction ID: b0c32911f3252874f0916f3187b09ba348a3e14526e3604a68050b0e865b7b9e
Opcode Fuzzy Hash: cbf103b6ad041aa013e52fc611b0184552ee62948ae99acf5f36f6584707a561
Instruction Fuzzy Hash: FB210476549340AFD7118F05EC41E62FFA8EB89630F08C5AFFD099B611D236A904CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 01400F91, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5de5c0e922198060bfd1c1dfdb22e61339ede6425652f22fa48a27e16f9053
Instruction ID: 2ac70a44ef5e3dfcedcb5199070f068ced9a2483bc6fef3917e48c482c5bdf5d
Opcode Fuzzy Hash: 3f5de5c0e922198060bfd1c1dfdb22e61339ede6425652f22fa48a27e16f9053
Instruction Fuzzy Hash: 0331DF74E00219DFCB45DFA9C884AAEBBF2BB49304F1081AAD805AB3A1C7759941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 011EA716, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b07b8bbc0d156fc98f387ec00fe4ad878f60209b1cc47ee9ef5c2d0d888d61
Instruction ID: 5e942f959e797f41b94fa7faa0259dd8bb909cef85c5f28485aa8da98f1555a5
Opcode Fuzzy Hash: 04b07b8bbc0d156fc98f387ec00fe4ad878f60209b1cc47ee9ef5c2d0d888d61
Instruction Fuzzy Hash: F2211AB6644304AFD310CF0AEC81A57FBE8EB88660F14C96EFD4997711D275E9148FA2

Uniqueness

Uniqueness Score: -1.00%

Function 011EA842, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfef96199060606aa4b977a28853e0c295dc846c92cc5256033b29c4395958cf
Instruction ID: c7bf48dc86d8e5854bbdd5acf99b6c3201c726a3e2bf5aad46c139f8ecbf6757
Opcode Fuzzy Hash: dfef96199060606aa4b977a28853e0c295dc846c92cc5256033b29c4395958cf
Instruction Fuzzy Hash: C1213AB6644300AFD310CF0AEC81A57FBE8EB88620F14C96EFD4997701D275E9148FA2

Uniqueness

Uniqueness Score: -1.00%

Function 011EA96E, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44d9f2d2e2a3f8a804c1bb926059a921ce640da9f86c33df616921413b9f4ed1
Instruction ID: 920de3cc6537c289f0b035128683d871ad03d7c7784dcde58b61a6fb4b978ec4
Opcode Fuzzy Hash: 44d9f2d2e2a3f8a804c1bb926059a921ce640da9f86c33df616921413b9f4ed1
Instruction Fuzzy Hash: 4C211AB6644300AFD710CF0AEC81A57FBE8EB88620F14C96EFD4997711D275E9148FA2

Uniqueness

Uniqueness Score: -1.00%

Function 01400006, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd119e65439d3d59a4abb1dd3ff3bb9506629fb2412ccdeafeb448f46b40bb36
Instruction ID: 65cb4f9b2ed198aa9d86aee6920d04fbb51c6efcb82034bee25fdaba0ff83c6f
Opcode Fuzzy Hash: dd119e65439d3d59a4abb1dd3ff3bb9506629fb2412ccdeafeb448f46b40bb36
Instruction Fuzzy Hash: AF21042049F3C19FC3079BB088395A97FB0AE4321471A85EFD081DB5A3DA6D4D59C776

Uniqueness

Uniqueness Score: -1.00%

Function 01400FA0, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec4add33be39c4c5acac8bf56c521a2f924e7f405e5d8fceeb51b300a1b4e6d
Instruction ID: 81f910638ed6aa0e65c0c6fa9ee016bd8e2268dd982a8acb58414212faa95139
Opcode Fuzzy Hash: aec4add33be39c4c5acac8bf56c521a2f924e7f405e5d8fceeb51b300a1b4e6d
Instruction Fuzzy Hash: 0B31D174E00219DFCB05DFA9C444AAEBBF2BF48304F10856AD855BB3A0CB719941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 011EA3D2, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73e30ce6d698994e9b039f3ec8ee0962ed44c16133bd37e57b481739c7141d10
Instruction ID: 611199b95ae1c139d3abe61549b7a78abcb4ca5bee3ad7085b4067a7549d5e3e
Opcode Fuzzy Hash: 73e30ce6d698994e9b039f3ec8ee0962ed44c16133bd37e57b481739c7141d10
Instruction Fuzzy Hash: C2118176644300ABD6108F0AEC81A67FBE8EB84630F18C56EFD095B711D276B5148EA2

Uniqueness

Uniqueness Score: -1.00%

Function 011EA5EA, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca7d55f69df4f218de373d0410379efcd39ab408296857448f66ecea3d70209f
Instruction ID: fcc12945405ecfc129fcdd1b5fd4cb5692e2bdb68236ab2d82e1d6a001ae540f
Opcode Fuzzy Hash: ca7d55f69df4f218de373d0410379efcd39ab408296857448f66ecea3d70209f
Instruction Fuzzy Hash: D9118176644300BBD6108F4AEC81A66FBE8EB84630F18C56EFD095B711D276F5148EA2

Uniqueness

Uniqueness Score: -1.00%

Function 011EA640, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42c61b4c2230892d237926427fcaf1c610d97ba3f9697bf168caaba31cd353e4
Instruction ID: 797ffb84397c92b87256f18af9cb85a5dd6d9905f444377c17af60eae926e3ca
Opcode Fuzzy Hash: 42c61b4c2230892d237926427fcaf1c610d97ba3f9697bf168caaba31cd353e4
Instruction Fuzzy Hash: F3215CB650D3806FD302CF25DC51956BFF4EF86620F0989DFF9889B252D235A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 011EA1BA, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6644903ac92779d3ab820d6aecbc764356becc07d19873f0c3619e7b8d3571f
Instruction ID: 42fc98add24c5a242f8ca78483515370e39ad1189f73b1eeb593aac283abd30d
Opcode Fuzzy Hash: b6644903ac92779d3ab820d6aecbc764356becc07d19873f0c3619e7b8d3571f
Instruction Fuzzy Hash: 1711A376640304BFD6108F0AEC41E62FBACEB84A30F18C46FFD095B601D276B5148EA1

Uniqueness

Uniqueness Score: -1.00%

Function 01401850, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7705c27f6d11f53b3e64aa78e0013e153148ada6088d5b031a34a60d4568210
Instruction ID: 8a18c18be2fd5b3fd3f0e4779aafb5a185d9b6b4763737168edc2107c52aaa08
Opcode Fuzzy Hash: c7705c27f6d11f53b3e64aa78e0013e153148ada6088d5b031a34a60d4568210
Instruction Fuzzy Hash: 0121F875D04209CFDB19DFEAD8445EEBBB1FB89310F20816AD811A7390D7349A41DF60

Uniqueness

Uniqueness Score: -1.00%

Function 0140AE08, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c45bdbf89961ceae61a28e017f99f038fcec6781737e4cf26e47a6c120d8bcd7
Instruction ID: d620143fd6a1aebae7aa3217cc5c4dbf244ae4ac096492019738603ed7a29f85
Opcode Fuzzy Hash: c45bdbf89961ceae61a28e017f99f038fcec6781737e4cf26e47a6c120d8bcd7
Instruction Fuzzy Hash: 0D11A070885349DFC752CBA4D4455ED7FF8EB46321F2042FAC449972A1D7790D938B51

Uniqueness

Uniqueness Score: -1.00%

Function 01409270, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bdf1157627b05e0730be1ea3c366148bfd6a7bbf1074a0cc45a3d07900f1ec2
Instruction ID: d73fc94a2271c8de45ccba8ec0e627e7f7eaa7b39f3ce62e4a954c9a3ff2bf10
Opcode Fuzzy Hash: 9bdf1157627b05e0730be1ea3c366148bfd6a7bbf1074a0cc45a3d07900f1ec2
Instruction Fuzzy Hash: B2212774D0520ADFCB15CFA9C4819EEBBB0FF49314F1084AAD809AB3A5D7359A42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 011D075C, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680866132.00000000011D0000.00000040.00000040.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec3bfd0c0382521f372c474b810a63f350bb86adcd1bf76f3ac6e12aeb83fa63
Instruction ID: e6b22440d43498ab1e75b36e946acddfe9eb7d338b17f93ff1d8ee92a9b57e60
Opcode Fuzzy Hash: ec3bfd0c0382521f372c474b810a63f350bb86adcd1bf76f3ac6e12aeb83fa63
Instruction Fuzzy Hash: BB11A235604644DFD719CB18C980B26BB95EB88708F24C5ACF9890B653C77BD803CE51

Uniqueness

Uniqueness Score: -1.00%

Function 01402468, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaa2dce500e6d10812b3d34e636f9638fd281c7269610204b05902607e16ab0b
Instruction ID: 1c294f7837cb782c26df80accdb9e88b201dd4989616a75799e208102434c69d
Opcode Fuzzy Hash: aaa2dce500e6d10812b3d34e636f9638fd281c7269610204b05902607e16ab0b
Instruction Fuzzy Hash: 2921E474D0021ACFDB65DFA9D948BADBBF0FB08304F1045BAD41AA7295DBB45A84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 011EAB09, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19ca62940369ce4c9ccde8a2e736940fb92b0088f94c22cf5315f45306168285
Instruction ID: c978a72b0c3dcc6ad33aff76273ff5c02cc9fef6afe8d636b36a7b255587ff8b
Opcode Fuzzy Hash: 19ca62940369ce4c9ccde8a2e736940fb92b0088f94c22cf5315f45306168285
Instruction Fuzzy Hash: DE11A7B5908301AFD350CF19D881A5BFBE4FB88664F14896EF99897311D275E9048FA2

Uniqueness

Uniqueness Score: -1.00%

Function 01409280, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04e6de7492f74edc467d98b2fad4e68976d569dea1ea5a736c259363f6effe70
Instruction ID: 3ea22c5b26f41a62af6c3e115e59468cd4e49b3e6a6eb1ea2ec25c01be90acf8
Opcode Fuzzy Hash: 04e6de7492f74edc467d98b2fad4e68976d569dea1ea5a736c259363f6effe70
Instruction Fuzzy Hash: BB21C574D05609CFCB05DF99C595AEEBBB1FF48314F10806AD809A73A5DB34AA41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 011EA118, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faf7b235788bb5b43eccc0005325762f7dba1f240ae95c88fa55c44a98bd2b89
Instruction ID: 81f616765436255708e2ee8dc5f41f676d263a970f01e0be73cb417b22700990
Opcode Fuzzy Hash: faf7b235788bb5b43eccc0005325762f7dba1f240ae95c88fa55c44a98bd2b89
Instruction Fuzzy Hash: 6F01D47254D3C02FD31247259C95A92BFB8DF43620F0884DBE9849F153D216A909CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0140A88F, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3f5d521763cc4de665e5b1df4c37e81aca24cb9ab700a024dead6c88ed176e
Instruction ID: b32e3fab6987b9266735cd896e8d3c1b2df9f5662da1f8838ededbf07e09e767
Opcode Fuzzy Hash: bf3f5d521763cc4de665e5b1df4c37e81aca24cb9ab700a024dead6c88ed176e
Instruction Fuzzy Hash: 0501693085A359DFDB46DFA495401EDBFB0EF82221F2085FEC405572A1D2794E8ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 011D05D0, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680866132.00000000011D0000.00000040.00000040.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c9dbbf42d455b6c98cd2e21b4e3c1adaa992a506767b903d516602262e7f16
Instruction ID: 7bf35d4bb2f314daa61d88b0afd96b522411fa1664cce3dba207aea584793e7f
Opcode Fuzzy Hash: b6c9dbbf42d455b6c98cd2e21b4e3c1adaa992a506767b903d516602262e7f16
Instruction Fuzzy Hash: 5701D6765097806FD7128B16DC40862FFB8EF86220708C0AFEC49CB612D125A808CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0140286A, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ead5f8673cb863b70605679a13caa6d2141f1c974af39a6e4f5cd8c1b1a9fd2c
Instruction ID: 60a7b1ee077ff495ca3339b126118ac1ea445530a3892c1ed5cf2f0c06eb361f
Opcode Fuzzy Hash: ead5f8673cb863b70605679a13caa6d2141f1c974af39a6e4f5cd8c1b1a9fd2c
Instruction Fuzzy Hash: D611077490021ECFDB68CFA8D948BADB7B1FB44308F1045BAD45AA7295CBB45E85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0140A858, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d1d4099d9d368d913174a8f9bab12376b84f8dd3b680a523028f025236f9191
Instruction ID: df13a4428b08ad0ac37118458d53a76bab77161eaefba7a5bdcca153522d578e
Opcode Fuzzy Hash: 5d1d4099d9d368d913174a8f9bab12376b84f8dd3b680a523028f025236f9191
Instruction Fuzzy Hash: 50F0A931856308DFD71ADEA9D4046BEBFB4EF46300F2009FAC809572A0D3368A4ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 011D075B, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680866132.00000000011D0000.00000040.00000040.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a89f344bb316c869cd7f12c8441c8e5b3610adbeb22bbfbaf552fb1514554208
Instruction ID: ec8990ae5abccafe4d6df3651e031f1c206f5ee81c59cae9edb8da2b31e3e72f
Opcode Fuzzy Hash: a89f344bb316c869cd7f12c8441c8e5b3610adbeb22bbfbaf552fb1514554208
Instruction Fuzzy Hash: 66014C35604685DFD71ACB14C580B25BBA2FB89718F28C6ADE9891BA52C337D813CF41

Uniqueness

Uniqueness Score: -1.00%

Function 014000B8, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fa0f404345034d7958584c36de59d443fb82c0a7fd741c8570c09fd51b79251
Instruction ID: 8ccd4ce95cb44b59feebcac9bdb38b48016bb8faece282a778f56468487b88a2
Opcode Fuzzy Hash: 6fa0f404345034d7958584c36de59d443fb82c0a7fd741c8570c09fd51b79251
Instruction Fuzzy Hash: ACF03730901249DFCB08EBA8D955AEDBFB2EF46704F2082BAD4046B265DB309E84DB41

Uniqueness

Uniqueness Score: -1.00%

Function 0140BECF, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbac3208a3af78c0db6605b1cc694084ee8c8b74dcc8f132774be17ba477b44e
Instruction ID: 784393a4dbbb26e274d475f5faded72031dc0f215e7600be6453d206736f74d6
Opcode Fuzzy Hash: fbac3208a3af78c0db6605b1cc694084ee8c8b74dcc8f132774be17ba477b44e
Instruction Fuzzy Hash: D1F04F34904209EFCB06CFA4C8409DD7FB1EF49310F10C5AAE80497261C7368A52DF91

Uniqueness

Uniqueness Score: -1.00%

Function 0140B7C4, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02a862afbdc84865356bc17247579ebd97e5bc6367bb58b29be2897e1645cac
Instruction ID: 58391d3ace73b21d486db116b142418820c67783792264aaf2c8f7b3ffb60ae2
Opcode Fuzzy Hash: f02a862afbdc84865356bc17247579ebd97e5bc6367bb58b29be2897e1645cac
Instruction Fuzzy Hash: 2501D279D0422CCFDBA5CF69C984BD8BBB5EB48304F1484EAD508A72A1C7359AC6DF44

Uniqueness

Uniqueness Score: -1.00%

Function 014026CB, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4f03470e04551ea346b41cd491256572d7a962d5fd5511cd92297a4978c96d
Instruction ID: 76853299997e47582d3ad008b0cb35aa05432bd3a7ed8666f0b72d4cfd47bc22
Opcode Fuzzy Hash: ee4f03470e04551ea346b41cd491256572d7a962d5fd5511cd92297a4978c96d
Instruction Fuzzy Hash: 3D011E74A00219CFDB64DF68D848B9DBBB1FB49304F1085AAD849A7295DB749E84CF00

Uniqueness

Uniqueness Score: -1.00%

Function 01401121, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe2683c340384764f018ce1094421f01a3b21a985828fa0eb32845ef70afd20f
Instruction ID: 927b5f7d67c4f664eabb59abe4d2cd1a268ab956b0a2a00e7bc5bdb10521466c
Opcode Fuzzy Hash: fe2683c340384764f018ce1094421f01a3b21a985828fa0eb32845ef70afd20f
Instruction Fuzzy Hash: B2F03A70809308DBCB599FE0E4055A97FB4EB5A711F1090AAD8095F2A1D3308A41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 011D0818, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680866132.00000000011D0000.00000040.00000040.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8388fa57679453dc7b04d871bb3dcfd317d9f8cb342853e5fed44ee7779b5e3e
Instruction ID: f033815519f8f2d3c0f2e4cbd8cc83e4acb414fd77f3c761c151a33c4d89f752
Opcode Fuzzy Hash: 8388fa57679453dc7b04d871bb3dcfd317d9f8cb342853e5fed44ee7779b5e3e
Instruction Fuzzy Hash: 59F01D35504645DFC706CF44D940B25FBA2EB89718F24C6ADE9890B752C337D813DE81

Uniqueness

Uniqueness Score: -1.00%

Function 014000C8, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50be458bd4c1cd0f924241af5a21fbcf7cb5bf43607ae7719a20ec07d55f8e3e
Instruction ID: aaea79f09889117350656cd995e87806d64a1343a275945cfab32ee9b39f01ef
Opcode Fuzzy Hash: 50be458bd4c1cd0f924241af5a21fbcf7cb5bf43607ae7719a20ec07d55f8e3e
Instruction Fuzzy Hash: F7F0DA3090020DDBC708EFA9D955AADBBB6FF45704F2092B9D4047B264DB30AE44DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0140A988, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 627591e516543c57b0f9de5508dca2eab021963f696716f7f5cf6bb8084830bd
Instruction ID: 8a159ea8277ffbd6dabcc73cf9140dc8d4e51d4b5a9b1f1c931fce383107e1b2
Opcode Fuzzy Hash: 627591e516543c57b0f9de5508dca2eab021963f696716f7f5cf6bb8084830bd
Instruction Fuzzy Hash: 0EF03430D45308DFCB19DFA4E5455EDBFB4EB46310F2081BAC805672A1C2790A85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0140C000, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e1a30c0ef87a30771a3b6f22f3a693a94ac00519192b24a3a80328ee7e32ce
Instruction ID: 47a7ab288685f9ff7f2e52409fc36fbf94fd00ff9e886c96a686225744ac4783
Opcode Fuzzy Hash: 07e1a30c0ef87a30771a3b6f22f3a693a94ac00519192b24a3a80328ee7e32ce
Instruction Fuzzy Hash: 3AF0FE70D45314DFCB56CBA4D4905ADBFB0EF46310F1081EAC80997351D7365E46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 011D05F6, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680866132.00000000011D0000.00000040.00000040.sdmp, Offset: 011D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ec2bec94671181e81e91a84386eff9d63937a178e6d449adef6f8a556d526ea
Instruction ID: 89b3417c6342a15b0c3aa530b08b31851ec47285a291decb3edbf3fabbcc7bc1
Opcode Fuzzy Hash: 9ec2bec94671181e81e91a84386eff9d63937a178e6d449adef6f8a556d526ea
Instruction Fuzzy Hash: 8AE092766407005BD650CF0AEC81452FBE8EB84630758C07FDC0D8BB00E535F504CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 0140A167, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7591c2164515f3e4532416b565e3863f29239a3c6a46b007a007729a3d71b795
Instruction ID: 678f22bf00ef237693c8a8708ee65e5a4ef46a9ede36ec2a09d9ee7a3b1c8c5c
Opcode Fuzzy Hash: 7591c2164515f3e4532416b565e3863f29239a3c6a46b007a007729a3d71b795
Instruction Fuzzy Hash: 8AF0653084A305EFCB57DFB485455EC7FB5EF42311F2086AAC4045B2A5D3364A66CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0140A9E1, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 681eac57a4ef09f662c9d7e10d789a24deac86b8a07f7187e097d7c119388bcb
Instruction ID: 699817b1439ea9e82ac2336600f9a39e3ea14599cbe80713851c962e38868a9d
Opcode Fuzzy Hash: 681eac57a4ef09f662c9d7e10d789a24deac86b8a07f7187e097d7c119388bcb
Instruction Fuzzy Hash: 73F01C30C45348DFCB56CBA4D54499DBFB0EB86310F1081EAD8149B2A1D3340A45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 014089F0, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f56720ae2e2883c5f3bc936719bd3e28c5f1a6d1fb10c4ca308fc27e3c6ebb0a
Instruction ID: 07e1a79e9e59792aeb6762d6e36ec2c508327918c47868216a1cb179b636459a
Opcode Fuzzy Hash: f56720ae2e2883c5f3bc936719bd3e28c5f1a6d1fb10c4ca308fc27e3c6ebb0a
Instruction Fuzzy Hash: 91F01530C46249EFCB06DFA8D9469ADBFB0AB86210F1081EAD804A76A1C2340A56CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01402380, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c3bbfb33c813ea4578c8c71293b76381acbff4a84239c31a733832511a7e458
Instruction ID: 9cbfa3bde9c10d828432118f43ca76e37ca0a1b7a7d00a7691e2d05d137b05eb
Opcode Fuzzy Hash: 6c3bbfb33c813ea4578c8c71293b76381acbff4a84239c31a733832511a7e458
Instruction Fuzzy Hash: A4F0F830D05349DFDB45DBA4D0455DCBFB0EB46310F2085FEC84597261C2795A42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 011EA6A3, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4901e3215d4f96453f3f5d8cb4596c7df1714b2e99e117bd43dff7728217b84
Instruction ID: 026f536eac01e128caa6154c5b3c09bd2caff50562c2a7c86e7eb11839565e82
Opcode Fuzzy Hash: b4901e3215d4f96453f3f5d8cb4596c7df1714b2e99e117bd43dff7728217b84
Instruction Fuzzy Hash: 5BE0D87264030467D2108F06DC82F12FB98EB40A30F04C46FEE081B701E071B5048EF1

Uniqueness

Uniqueness Score: -1.00%

Function 011EA7CF, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a32237d0fa30869ea14231a11d7cd377c4bb357038d5455291f05e502c9b43ea
Instruction ID: f4e1031db5e7f66f8540a66cdf6dc9499d6080ff5064f5448379d760f4ca61da
Opcode Fuzzy Hash: a32237d0fa30869ea14231a11d7cd377c4bb357038d5455291f05e502c9b43ea
Instruction Fuzzy Hash: 7FE0D87264030467D2108F06DC82F12FB98EB40A30F14C46FEE081B701E075F5048EE5

Uniqueness

Uniqueness Score: -1.00%

Function 011EA14C, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47abae5474dd7cefce78937ded3280d268b705334fbfa12990aec1afc61a2939
Instruction ID: 862e915af1a83e62b0a597b560f3c68304eab1dd7da338202291b5d1584b32ad
Opcode Fuzzy Hash: 47abae5474dd7cefce78937ded3280d268b705334fbfa12990aec1afc61a2939
Instruction Fuzzy Hash: 59E0D87264030067D2108E06DC82B12FB98EB40A30F44C4ABED081B701E075B5048EE1

Uniqueness

Uniqueness Score: -1.00%

Function 011EA8FB, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08fd73c6cff86bc80620df26b0ba2882d8b8c44599edf641d87212f8423fb2be
Instruction ID: f9e3fdc7d7af3d6d76d369c6747a2546a4abefd41f273d94feea59cb6f307a86
Opcode Fuzzy Hash: 08fd73c6cff86bc80620df26b0ba2882d8b8c44599edf641d87212f8423fb2be
Instruction Fuzzy Hash: A2E0D87264030067D2209F06DCC2F13FB98EB40A30F04C46FEE091B701E071B5048EE1

Uniqueness

Uniqueness Score: -1.00%

Function 011EA57B, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3e06eb9e1757dcb56b9ad86921876c39f80c93a11d692eb104c7ed93968c07
Instruction ID: 8f09adc753ee3b9c2a5c810eb5e81a1b474ef3fd5e7c2e1276ae16277ab46cbb
Opcode Fuzzy Hash: 1d3e06eb9e1757dcb56b9ad86921876c39f80c93a11d692eb104c7ed93968c07
Instruction Fuzzy Hash: 2EE0D872A4030067D2108E0ADC82B12FB98EB40A30F48C4ABED081B701E075F5048EE1

Uniqueness

Uniqueness Score: -1.00%

Function 011EAB6B, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc227922e424427d00300b97e023a36474abc68c90ca9caaece5960556ee311f
Instruction ID: 93450593ba907b3311505420b5959a18ce4da3983dfd9ff4061b34c56e952d82
Opcode Fuzzy Hash: bc227922e424427d00300b97e023a36474abc68c90ca9caaece5960556ee311f
Instruction Fuzzy Hash: 6FE0D87264030067D2108E06DC82B22FB98EB40A30F44C56BFD081B741E071B5148EE1

Uniqueness

Uniqueness Score: -1.00%

Function 011EA363, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680880477.00000000011E2000.00000040.00000001.sdmp, Offset: 011E2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a64aadcb2ffaf3942b09431456cff68557e86345cdf0a11f920b36f86516ea3
Instruction ID: 36228b6cce42e1060a70edc12632cf1616467df425e9f672651acff753219f1a
Opcode Fuzzy Hash: 7a64aadcb2ffaf3942b09431456cff68557e86345cdf0a11f920b36f86516ea3
Instruction Fuzzy Hash: 63E0487264170467D2509E0ADC86B52FB98EB44A30F54C56BED095B701E175B5048EE5

Uniqueness

Uniqueness Score: -1.00%

Function 0140A948, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a162fbacc286bc5519fa271514c63e321c260e6ee17c01293c155c3b0e32eb0
Instruction ID: b1a77cfb26ef5b4b3f1f0e07403a87304ea01a1418fdd07b17b962585e2b5f2b
Opcode Fuzzy Hash: 7a162fbacc286bc5519fa271514c63e321c260e6ee17c01293c155c3b0e32eb0
Instruction Fuzzy Hash: 90E06D7098A348DFCB56CBE498459ED7FB4AB42211F1041AAD809572A1D2350A56CB91

Uniqueness

Uniqueness Score: -1.00%

Function 014019D0, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3243dab440423eb1449598cdd2fc728ee045dce101107a816cd862fe1c560a5
Instruction ID: 83575bc86e3a29e6cfdc8a9121762ceec12e76175a6cc8c0a2062352cdf18f87
Opcode Fuzzy Hash: f3243dab440423eb1449598cdd2fc728ee045dce101107a816cd862fe1c560a5
Instruction Fuzzy Hash: 00E06D30C1534ADFCB66CFE890451A97FB0EB06321F1086EEC805572A1D2304981CB21

Uniqueness

Uniqueness Score: -1.00%

Function 01402408, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28a22056d5f9c4fee8dbf6dbe335e8534edd89f0c226e7d616617028b97afa5d
Instruction ID: 4e7052e25ad163214c31df0cc579144a6e6e420a4708d53b68d587554e58e7b5
Opcode Fuzzy Hash: 28a22056d5f9c4fee8dbf6dbe335e8534edd89f0c226e7d616617028b97afa5d
Instruction Fuzzy Hash: C7F01570C15308EFCB55DFA8D04599EBFB4EB99320F6085BED804A6251D2758A82DB81

Uniqueness

Uniqueness Score: -1.00%

Function 01401130, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8ed5c982f8502bd4ed38315dfc89dc6b831064e20fa773521f04b2421402f4b
Instruction ID: 7318619bc4b8af35fb82f96a778aaf3fd82034e7887ee083ee1c5cf81bec4307
Opcode Fuzzy Hash: a8ed5c982f8502bd4ed38315dfc89dc6b831064e20fa773521f04b2421402f4b
Instruction Fuzzy Hash: 4CE09230808208DBCB1CEFD5E4055BDBF74EB4A701F109079DC1A1B394C7309981CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01402E57, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90d264ff34d061aedf595b04d86f280df4a8727a623d48a942ed00984b626ca5
Instruction ID: a6080379c8b4dd5d050e3ac3c386847d4d0b73c9ffa876df94dfcbc764797f43
Opcode Fuzzy Hash: 90d264ff34d061aedf595b04d86f280df4a8727a623d48a942ed00984b626ca5
Instruction Fuzzy Hash: 0AE06D30896349DFCB45DFB8D4056ECBFB0EB46221F1081FAC885932A1D2794A46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01401E90, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 468e1e570a25d4ec22a1385a00290f30ff5e9e08751f7199785abf5745fa466b
Instruction ID: 3393cdca6952e360f6fdae542eafe8c68a45b3af9a06a402d580664786843802
Opcode Fuzzy Hash: 468e1e570a25d4ec22a1385a00290f30ff5e9e08751f7199785abf5745fa466b
Instruction Fuzzy Hash: 33F01570C0A2489FDB15CFE9E4859AEBFB0BB46320F1486BAC814973A1D2304A40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0140B162, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c8c4b57141748807e5bda9ac4d622048d017ed4ab0d24fd735a0723157a631f
Instruction ID: fa921382285143654be9f70f8804759d0117206fcf8b0eb7c2cdd36c7ec7fb28
Opcode Fuzzy Hash: 0c8c4b57141748807e5bda9ac4d622048d017ed4ab0d24fd735a0723157a631f
Instruction Fuzzy Hash: FEF0F279904228CFCB65CF54C881BE9B7B1FB08304F0484AAE908E72A1C7359AC6DF95

Uniqueness

Uniqueness Score: -1.00%

Function 0140A1EA, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5283364bb9be910d826ad89b6fd4281e74d8034d23bbf83cc934db367e1e4e2
Instruction ID: bfdbf08ba3b7f7223fdc1afc872ce926fc563faf5bdc0cf91ee74037f092403d
Opcode Fuzzy Hash: a5283364bb9be910d826ad89b6fd4281e74d8034d23bbf83cc934db367e1e4e2
Instruction Fuzzy Hash: B9E0ED3088A354DFCB1ADBE494095ED7FB4AB86221F1041FED405572A6D6350996CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01401DFF, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39907ce2c4dcc23c250491dbe19e802699ecfc764aa9a07f0b4b92a462235410
Instruction ID: 3780e664fc35f997aa9180246ceea6bbfb8934969e759fa2a26b629ba2065a7a
Opcode Fuzzy Hash: 39907ce2c4dcc23c250491dbe19e802699ecfc764aa9a07f0b4b92a462235410
Instruction Fuzzy Hash: 8FE0DF70D49249DFCF16DFF899512ED7FB0AB42320F248ABFC80453292E2708A00C794

Uniqueness

Uniqueness Score: -1.00%

Function 014011B0, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c5a662d6bee5b931543cd9c5c087d6c791f156fc6d975695f93c3654e5fad9
Instruction ID: 20f50488b1c1054f62998c2dcc7f81d57804a34c167e3a1d054de04e794e360d
Opcode Fuzzy Hash: 43c5a662d6bee5b931543cd9c5c087d6c791f156fc6d975695f93c3654e5fad9
Instruction Fuzzy Hash: 6FE06D30809304DFCB2ADFE4E9814DD7F70EF46311F5085BAD8045B295C3304A55DB90

Uniqueness

Uniqueness Score: -1.00%

Function 01400070, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d27d7a975030ad12f31c5a377050da9c9c5fa22e89380d53d6a0e1e59b6e2b1a
Instruction ID: fc00ecdf8c37a41ede9a5ad191f1963acebb8274c191b3bad15571153d98c7dc
Opcode Fuzzy Hash: d27d7a975030ad12f31c5a377050da9c9c5fa22e89380d53d6a0e1e59b6e2b1a
Instruction Fuzzy Hash: 84E086705622089AC71CFBF8951666E7FA9AB42244F201C7D940127240CE356E20C799

Uniqueness

Uniqueness Score: -1.00%

Function 0140A8D0, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f67b61b82459446b9888e822777e0e3b86097d11e609c3f7d7f0d0fe3f1036df
Instruction ID: ee2202bd95cb95bd5fb76b8f21dc505e91980714fb766ea32df63a494653363f
Opcode Fuzzy Hash: f67b61b82459446b9888e822777e0e3b86097d11e609c3f7d7f0d0fe3f1036df
Instruction Fuzzy Hash: 8EE09230C56349DFCB55DFB495411EC7FB0EF46221F1081FEC805572A1D2755A86CB51

Uniqueness

Uniqueness Score: -1.00%

Function 014023C8, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8afd7b697170513d0796bec7efd24fbc5b9117191be38218adcead680c6eff80
Instruction ID: 958c741b69c16054c2dbd255aa80901026b58791c5145a9a1c5add807ee50602
Opcode Fuzzy Hash: 8afd7b697170513d0796bec7efd24fbc5b9117191be38218adcead680c6eff80
Instruction Fuzzy Hash: B7F03230C56348DFCB86DBB8D484AE87FB4FB06211F1042EAD804AB2B6C2759E55DB11

Uniqueness

Uniqueness Score: -1.00%

Function 0140BEE0, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ddb1f9b8f2343fb16157e132985731ad8c30f0ae5b5378b2d388969bc882903
Instruction ID: 09f9eb1ff50f1eca4b9cce995fbd41dabe3bc20b5c943b27ef5768913cb87a2b
Opcode Fuzzy Hash: 0ddb1f9b8f2343fb16157e132985731ad8c30f0ae5b5378b2d388969bc882903
Instruction Fuzzy Hash: DBF0153890020DEFCB05DF99D9409ADBFB5FB48310F10C4AAED18573A1C7329A62EB90

Uniqueness

Uniqueness Score: -1.00%

Function 01408EE8, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c5fd4622a258374474b503ba7ad082c50d6f5a51f2e9db27420664c419be94
Instruction ID: 44579eafc6ddd828b70b33dd7e489c4a7bf1938a99ec7e464fa0197cbc31a58c
Opcode Fuzzy Hash: b1c5fd4622a258374474b503ba7ad082c50d6f5a51f2e9db27420664c419be94
Instruction Fuzzy Hash: D4E0653085A349DFCB56DBB889196ADBFB0EB86310F1001EAD900972A2E7394A51CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0140A998, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3298a0b5d2c2d1c88b8a2d03c2d52d6bf7c710e45ff0ddbf31c0c8488cf8000e
Instruction ID: 6ef3b17f477a4e2c0212ab0fbfcc5de9f9dcaf8f58c59f5fafef576cb040b6e1
Opcode Fuzzy Hash: 3298a0b5d2c2d1c88b8a2d03c2d52d6bf7c710e45ff0ddbf31c0c8488cf8000e
Instruction Fuzzy Hash: 17E06534D01208DBC708DFE4E2449AEBBF5EB85300F2081B9C80523394C7341A89CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0140C049, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0021e0a47e3dcba1f899d7771d9d2ae9ee1666f35b4be439bce18c77c2a1f3d
Instruction ID: 87da3fbe817b2a51345940f6a2881c6224276d5ad4dfd5e49669b6ddb9e332cf
Opcode Fuzzy Hash: d0021e0a47e3dcba1f899d7771d9d2ae9ee1666f35b4be439bce18c77c2a1f3d
Instruction Fuzzy Hash: F3E08C70C8B344DFC316CBF4A841AA97BA8AB83210F1056FE8004A76A2C2760E1AC710

Uniqueness

Uniqueness Score: -1.00%

Function 0140A81A, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c639b006d2ed7a7c22022ea4b0c7c4df0fbbfc78c60386eb98848a9b66e56ddf
Instruction ID: cafe52ac0dfb1f17179f1861da1d921ac54a87ad2416afc779241afe9fab2fac
Opcode Fuzzy Hash: c639b006d2ed7a7c22022ea4b0c7c4df0fbbfc78c60386eb98848a9b66e56ddf
Instruction Fuzzy Hash: 03E01A34C5A348DFCB46DBA8D5445ECBFF0AF46210F2041EAD8449B2A2E2795E59CB51

Uniqueness

Uniqueness Score: -1.00%

Function 014088E7, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94cf1af5531c87669663b4770d816d88a522f8000db1324de00e04fb664b13a0
Instruction ID: e16a48144752e68ef6c3392ee11dd84f6d14d2ddadda4063c8239e17a4382fbf
Opcode Fuzzy Hash: 94cf1af5531c87669663b4770d816d88a522f8000db1324de00e04fb664b13a0
Instruction Fuzzy Hash: 1CE0ED3085A348DFCB56EFA8A5456AC7FB0AB46310F1001AED805532A1E7790A55CB11

Uniqueness

Uniqueness Score: -1.00%

Function 0140A911, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07aec99b687460b1e42181b062e40dec38f9092a8e55e073d4597cc457cad220
Instruction ID: 682d9727a859dcd1755ef9e5426fb00e1fae744dbf580c9ec164046b9d121710
Opcode Fuzzy Hash: 07aec99b687460b1e42181b062e40dec38f9092a8e55e073d4597cc457cad220
Instruction Fuzzy Hash: 98E0C23189B348DFC356CBA49810AB93FB89B47220F2148EFD004971B1D6790E11CB10

Uniqueness

Uniqueness Score: -1.00%

Function 0140A130, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d91ab3733276d84be4f872fe80cb99b45b89a6ef69fbe36f9bffcc1452b2063d
Instruction ID: ece456da92f5305c0a4c909ece3ca167bad60cb15157656a9dcc832ac1ee689c
Opcode Fuzzy Hash: d91ab3733276d84be4f872fe80cb99b45b89a6ef69fbe36f9bffcc1452b2063d
Instruction Fuzzy Hash: F4E0863055A345DFC792DBA8A4095BDBFF8EF42325F2008AFD84497262D2790D21C711

Uniqueness

Uniqueness Score: -1.00%

Function 0140A178, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1903d68a8e9f5171450b7be38cb74d2f780370e814e0ec39f8619ba5474872f2
Instruction ID: 63eeb17d6f0b54332b608fe29aa43b488590bd58162556a218a0e24870f15f0c
Opcode Fuzzy Hash: 1903d68a8e9f5171450b7be38cb74d2f780370e814e0ec39f8619ba5474872f2
Instruction Fuzzy Hash: 30D01230806208DBC71ADFA595095ADBBB9AB41301F2045BDC8042B398D7355A45C791

Uniqueness

Uniqueness Score: -1.00%

Function 01402E68, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5c896d7c58b928e8966197ae9d6e555b34c222a0d1e985b99c4fb2efd1a02ab
Instruction ID: 169ea2246bf64ceb763dea73b9a28f26e00238f0ca4016c92ec0602441e31a63
Opcode Fuzzy Hash: b5c896d7c58b928e8966197ae9d6e555b34c222a0d1e985b99c4fb2efd1a02ab
Instruction Fuzzy Hash: 72D05E70896208DBCB04EFE8D509AADBFB8EB05211F1041BACC48633D0E7705E54CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01402A09, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6865cdc7cda591729936e62f1fe9d5d970a4972e53966139d33a06e17a1f0d3
Instruction ID: 444bd40d25d58935e06310ee5177cefe4982e3b3caaf16c0e9e0d10040e154da
Opcode Fuzzy Hash: b6865cdc7cda591729936e62f1fe9d5d970a4972e53966139d33a06e17a1f0d3
Instruction Fuzzy Hash: 2DE07D74A011998FDBA4DF54D85879CB7B1FB85340F1089A7990FA6254DB745DC48F00

Uniqueness

Uniqueness Score: -1.00%

Function 011C23F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680853854.00000000011C2000.00000040.00000001.sdmp, Offset: 011C2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82b3ff037fd04923e0921ac22c5a87d0a66ab46f9c7e054d5c064557d3c9ff8
Instruction ID: 8e14ab468bef0732c1aac4aba96d4ea283e40510106a4855d47f0147be26040a
Opcode Fuzzy Hash: c82b3ff037fd04923e0921ac22c5a87d0a66ab46f9c7e054d5c064557d3c9ff8
Instruction Fuzzy Hash: ECD05E79305A914FE32A8A1CC1A8B957FE4AB61B04F5644FDE8008B667C379D681D200

Uniqueness

Uniqueness Score: -1.00%

Function 0140A140, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f6313c4f833f7a696af294d3218e09aaf03d32a0b7ad8aca038cb843403cad
Instruction ID: 0956b4d00c0df80bc077a927d50a88db9cd896d0d34399814383b3766206a9ab
Opcode Fuzzy Hash: d0f6313c4f833f7a696af294d3218e09aaf03d32a0b7ad8aca038cb843403cad
Instruction Fuzzy Hash: 0CD02230506208DBC700FBE98108ABEBBECEB06310F2008B9C80847390E6705D0083A0

Uniqueness

Uniqueness Score: -1.00%

Function 011C23BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680853854.00000000011C2000.00000040.00000001.sdmp, Offset: 011C2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc7591125d98672ac25117bc3cd1c3dc0f8918a9dfa9f7a85be6e6748b823005
Instruction ID: bbf8aec497bd6563e583bb9b5bd1a950768534eda727bcf9046302ffc86a4644
Opcode Fuzzy Hash: fc7591125d98672ac25117bc3cd1c3dc0f8918a9dfa9f7a85be6e6748b823005
Instruction Fuzzy Hash: 71D05E343042814BD719DB0CC194F593BD4AB55B00F0654ECAD008B266C7B4D881C600

Uniqueness

Uniqueness Score: -1.00%

Function 0140BB4D, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85e6c7d9163c8f7d7db14c6d1bdc811d61766cdaa07faaae4ea0bbc0d81d712c
Instruction ID: 083726e8a3843bc4ceaa6f52aec3f3ff92fb8705bdeb5a986bd2a364e1ba1ee2
Opcode Fuzzy Hash: 85e6c7d9163c8f7d7db14c6d1bdc811d61766cdaa07faaae4ea0bbc0d81d712c
Instruction Fuzzy Hash: 1DE0B678900228CFCB54CF51C884BD8BBB1EB48354F1080DA880967290CB365AC6DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0140B601, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f37185cabf1046bb2b525afc1e581c477e05ac66c4a44fd0497ac4380668bd4
Instruction ID: d882ca65f61c3458192aed51ea4925b5f756d55a726ae1f59bceecf24d837922
Opcode Fuzzy Hash: 2f37185cabf1046bb2b525afc1e581c477e05ac66c4a44fd0497ac4380668bd4
Instruction Fuzzy Hash: 22E0B6789002288FCB55CF20C8847D8BBB1FB49314F1081DA880967391CB355BC6EF40

Uniqueness

Uniqueness Score: -1.00%

Function 0140B697, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 580b6c6e25dba38a01b7d91be3bc8f2c925bbd4e24155267ad04284406a7b974
Instruction ID: 7fb4fa8de35acb67aabdc11624c7c5086bfe7936175db3467ee82b1a8f176060
Opcode Fuzzy Hash: 580b6c6e25dba38a01b7d91be3bc8f2c925bbd4e24155267ad04284406a7b974
Instruction Fuzzy Hash: 05D0EAB8D0422C9FCB74CFA5E8987D8BBB1FB09305F2091EAD419A7251DB301A84EF44

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01402E98, Relevance: 3.9, Strings: 3, Instructions: 141COMMON

Download Yara Rule

Strings

f]kq, xrefs: 01402EF8
>_kq, xrefs: 01402FE1
:@fq, xrefs: 01402FC4

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: :@fq$>_kq$f]kq
API String ID: 0-1744552541
Opcode ID: 577c72fa2bdec89f2e4b00c63be754a6560b7d28ad529f5d14744cbe2459164b
Instruction ID: 3757442b074b67b10dd96c3ef92313d24f3af7406d1ee9481151da542d3477bf
Opcode Fuzzy Hash: 577c72fa2bdec89f2e4b00c63be754a6560b7d28ad529f5d14744cbe2459164b
Instruction Fuzzy Hash: 9F513E71A002098FE718DFEAD9447ADBBF2FF94304F14C53AD114AB2A8DF7658468B91

Uniqueness

Uniqueness Score: -1.00%

Function 01402EA8, Relevance: 3.9, Strings: 3, Instructions: 136COMMON

Download Yara Rule

Strings

f]kq, xrefs: 01402EF8
>_kq, xrefs: 01402FE1
:@fq, xrefs: 01402FC4

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: :@fq$>_kq$f]kq
API String ID: 0-1744552541
Opcode ID: 20d109627a3705d655336c0ca89d9f037c0c188ad92ae3adf34807edee7ade0d
Instruction ID: 0ef6b0cca18fee825168d5836a2725d3cb52e5ec8cfc0a02601517362740b631
Opcode Fuzzy Hash: 20d109627a3705d655336c0ca89d9f037c0c188ad92ae3adf34807edee7ade0d
Instruction Fuzzy Hash: 09512D70A002098FE718EFEAD9447ADBBF2FF94304F14C53AD114AB298DF7558868B91

Uniqueness

Uniqueness Score: -1.00%

Function 01404E86, Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

*, xrefs: 014051D2

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: *
API String ID: 0-163128923
Opcode ID: 70baf4070690d6cea7fed6bb71717392caeeaa44b20293c8754904a780e93805
Instruction ID: 5b1ee65b669213bdece0164e7f07e63bbeb7ec9f8f29795466d51bd5a096ae35
Opcode Fuzzy Hash: 70baf4070690d6cea7fed6bb71717392caeeaa44b20293c8754904a780e93805
Instruction Fuzzy Hash: 45B19FB0D4066E8BEB64DF69C884BDDBBF1FB88304F5081E9D158A7215DB309A95CF44

Uniqueness

Uniqueness Score: -1.00%

Function 014030DF, Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

9, xrefs: 01403230

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: ba96ec6cfa7847420ca8dba0cef24972346da9a42a734a6129c4229bf8f207c7
Instruction ID: 1c4790164eb75f575e3176c1cfa2721d192443622c816f345611be7706a9a67a
Opcode Fuzzy Hash: ba96ec6cfa7847420ca8dba0cef24972346da9a42a734a6129c4229bf8f207c7
Instruction Fuzzy Hash: D54135B1E006598BEB6CCF6BCC4178AFAF7BFC5210F14C5BA950DA6254EB3005868F55

Uniqueness

Uniqueness Score: -1.00%

Function 014030F0, Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

9, xrefs: 01403230

Memory Dump Source

Source File: 00000000.00000002.681066740.0000000001400000.00000040.00000001.sdmp, Offset: 01400000, based on PE: false

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: b959cc42539c7472154934e8399176da5f70fac9233a6a1fa147ae7833837936
Instruction ID: 135602ffeb12ae71bad9f85fdafcc805f428e7eb92c0174381d50bcc11efce70
Opcode Fuzzy Hash: b959cc42539c7472154934e8399176da5f70fac9233a6a1fa147ae7833837936
Instruction Fuzzy Hash: 2A4100B1E016588BEB6CCF6B8C4079AFAF7BFC9210F14C5BA851DA6254EB3005868F55

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Payment Notification.pdf.scr

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: NanoCore

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

AV Detection:

E-Banking Fraud:

System Summary:

Stealing of Sensitive Information:

Remote Access Functionality:

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre